CriticalCVE
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
The Hacker News·Source published ·1 min read
What happened?
Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0.
Key details
- Two critical Langflow flaws allow unauthenticated attackers to bypass authentication or run arbitrary code.
- All Langflow releases from 1.0.0 through 1.12.8 contain the four flaws detailed in IBM's bulletin.
- CVE-2026-93680 is an authentication bypass exploitable via the Model Context Protocol endpoint.
- A Metasploit module for CVE-2026-93680 connects to the MCP endpoint without credentials and lists tools.
- Automatic login is enabled by default in Langflow 1.12.8 and logs users in as superusers without prompting.
- One flaw is described as an incomplete remediation of the auto-login security control.
- IBM published 29 additional Langflow CVE records on October 29, including another critical unauthenticated RCE.
Affected
- Langflow versions 1.0.0 through 1.12.8 are affected by the four flaws.
Fixes and mitigations
- Upgrade to Langflow 1.13.0, released October 22, which turns automatic login off by default.
- Back up database, secret key, and uploaded files before upgrading with pip install --upgrade "langflow==1.13.0".
What to look for
- Metasploit module connects to MCP endpoint without credentials and enumerates tools.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.