BM is urging users of Langflow OSS to upgrade after disclosing multiple security vulnerabilities, including two critical flaws that could allow remote attackers to bypass authentication or execute arbitrary code on affected servers.
The IBM security bulletin covers Langflow OSS versions 1.0.0 through 1.12.8. IBM recommends upgrading to version 1.13.0 and says there are no separate workarounds or mitigations for the issues.
Langflow is an open-source, Python-based framework for building AI applications, including agents, chatbots and workflows that use the Model Context Protocol, or MCP. Its visual editor lets developers assemble applications by connecting reusable components. Langflow’s documentation describes MCP and agent support as core capabilities of the platform.
The most severe vulnerabilities are CVE-2026-93680 and CVE-2026-110186, both assigned CVSS scores of 9.8 out of 10 by IBM.
CVE-2026-93680 is an improper authentication vulnerability that could allow a remote attacker to bypass security restrictions. IBM’s CVSS assessment says exploitation requires no authentication or user interaction and can have a high impact on confidentiality, integrity and availability.
CVE-2026-110186 is a code injection flaw that could allow an unauthenticated remote attacker to execute arbitrary code. IBM’s bulletin identifies unauthenticated remote code execution through MCP tool enumeration as one of the security problems addressed by the update. The flaw also carries a 9.8 CVSS score and requires no privileges or user interaction under IBM’s assessment.
A third vulnerability, CVE-2026-110193, is rated 8.8. It affects Langflow’s Agentic Assistant and requires a low-privileged authenticated account. IBM says an attacker could cause the assistant to generate or submit component code containing patterns that were not adequately blocked, resulting in operating system command execution on the Langflow server.
CVE-2026-110192, rated 6.5, involves insufficient protection of credentials. According to IBM, an authenticated remote attacker could use the flaw to obtain sensitive information. The bulletin’s broader summary says API credentials injected by an operator could be exposed without the intended authorization.
IBM also identifies three vulnerabilities in Hono, a web framework included among Langflow’s open-source dependencies. CVE-2026-84363 can cause inconsistent handling of URL fragments and query parameters under certain deployment conditions, potentially enabling filtering bypasses, cache poisoning or stored cross-site scripting. CVE-2026-84364 can cause excessive memory consumption when applications enable dot-notation parsing for form fields, potentially allowing denial-of-service attacks. CVE-2026-84365 is a path traversal problem affecting Hono’s build-time static site generation. Hono addressed all three issues in version 4.13.5.
The Langflow fixes are included in version 1.13.0, released Oct. 22. Among its security-related changes, the release disables automatic login by default, blocks unsafe module re-exports in assistant code scanning and enforces credential egress policies across provider components.
IBM published its bulletin on Oct. 28 and updated it on Oct. 29. The company advises organizations running Langflow OSS 1.0.0 through 1.12.8 to move directly to version 1.13.0. For Python installations, IBM specifies upgrading the Langflow package to 1.13.0, while Docker users should move to the langflowai/langflow:1.13.0 image.
IBM also recommends backing up the Langflow database, secret key and uploaded files before performing the upgrade. Deployments using automatic login may need to prepare the existing account for password-based sign-in before moving to the new release.
Leave a Reply