IBM published a security bulletin for Langflow OSS, the open source builder for AI agents and workflows, on October 28, 2026 and updated it on October 29. Versions 1.0.0 to 1.12.8 are affected.
Two flaws carry a CVSS base score of 9.8, the critical range. Both are reachable over the network without an account.
CVE-2026-93680 is an authentication bypass. IBM describes it as an incomplete remediation of the auto-login security control.
CVE-2026-110186 allows remote code execution without authentication, exploitable through Model Context Protocol tool enumeration.
Two more Langflow issues are listed. CVE-2026-110193, rated 8.8, lets a low-privileged user make the Agentic Assistant generate code that runs operating system commands on the server. CVE-2026-110192, rated 6.5, exposes operator-supplied API keys. The bulletin also covers vulnerable versions of the Hono web framework bundled as a dependency.
IBM recommends upgrading to Langflow OSS 1.13.0 now, through PyPI or the langflowai/langflow:1.13.0 Docker image. There is no interim workaround. Before upgrading, back up the database, the secret key and uploaded files. Deployments that use automatic login need to prepare an account for password sign-in.
Why this matters
Agent builders hold API keys, connectors and the right to run code, which makes an exposed instance a direct path into the systems behind it. Any Langflow server reachable from the internet on 1.12.8 or older should be treated as at risk until it is upgraded.
Sources: IBM security bulletin.
This article is not legal advice.
