Langflow CVE-2026-93680 and 32 more bugs. Strangers can get into 1.12.x servers, so upgrade to 1.13.0

Two bugs in every Langflow release up to 1.12.8 let anyone who can reach the server skip its login check or run code on it without an account. CVE-2026-93680 (authentication bypass) and CVE-2026-110186 (code execution) are both rated 9.8, and they are the worst of 33 Langflow CVEs that IBM, which now acts as the CVE authority for Langflow after buying DataStax, pushed to the public CVE list on Thursday Oct 29 at about 11:15 AM ET. Langflow 1.13.0 fixes all 33. There is no 1.12.x release that does.

The rest of the batch mostly needs a logged-in user: three 9.9 code-execution bugs, a dozen more rated 8.8 or 8.5, then SSRF, path traversal, credential leaks and denial of service. On a default 1.12.x install that bar is lower than it sounds, because automatic login is on and Langflow signs every visitor in as its bootstrap superuser. CVE-2026-93680 already has public attack code. Metasploit's Oct 23 release added a module for CVE-2026-93680 that opens Langflow's MCP endpoint at /api/v1/mcp/sse without credentials and pulls the MCP server details. The module targets 1.5.0 through 1.11.4; IBM's record says the bug runs through 1.12.8. We found no report of in-the-wild exploitation for any of the 33 when we checked at 11:50 AM ET, and none is on the CISA KEV list (catalog 2026.10.28). Six older Langflow CVEs are.

How to fix

Upgrade to Langflow 1.13.0. With pip or uv:

pip install --upgrade "langflow==1.13.0"
# or
uv pip install --upgrade "langflow==1.13.0"

With Docker, pull the pinned tag rather than trusting whatever latest resolved to last month:

docker pull langflowai/langflow:1.13.0

Before you restart, set a superuser password. Langflow 1.13.0 turns automatic login off by default, and a 1.12 install upgraded in place will refuse to start with Username and password must be set until you do:

export LANGFLOW_AUTO_LOGIN=false
export LANGFLOW_SUPERUSER=langflow
export LANGFLOW_SUPERUSER_PASSWORD='use-a-long-random-value'

There is a second trap. If the instance was using auto-login, the existing langflow account already has a login timestamp and a generated password, so setting LANGFLOW_SUPERUSER_PASSWORD does not change it and sign-in fails with Incorrect username or password. The Langflow docs cover recovery under Recover access after upgrading: turn auto-login back on briefly, set a password on that account through PATCH /api/v1/users/{id}, then turn it off again. If the server is reachable from the internet, close the port while you do that, since those few minutes put you back in the exposed state.

IBM split the fixes across three bulletins. If you are pinned and cannot jump straight to 1.13.0, 1.12.4 clears 16 of today's IDs and 1.12.5 clears 13 more. The four that run through 1.12.8, including both no-login bugs, are fixed only in 1.13.0.

Which Langflow version are you running?

pip show langflow | grep -i ^version
curl -s http://localhost:7860/api/v1/version
docker inspect --format '{{.Config.Image}}' <container>

Anything from 1.0.0 to 1.12.8 is affected by at least one of the 33. While you are there, check whether auto-login is on. If opening the UI in a private browser window drops you straight into the flow list with no login form, it is.

To see whether the MCP endpoint answers strangers, run this from a machine with no Langflow session. If the status line says 200 and an event stream starts, it is open to anyone; 401 or 403 means it asked for credentials:

curl --include --max-time 5 http://your-langflow:7860/api/v1/mcp/sse

Then check what is listening. Langflow defaults to port 7860. If ss -ltnp | grep 7860 shows 0.0.0.0:7860 on a machine with a public address, or your cloud security group allows 7860 from anywhere, treat this as urgent.

Who is exposed, and who is not

The people who should move today are those running Langflow on a server other people can reach: a team's shared agent builder on a cloud VM, a demo box, a container behind a load balancer with no SSO in front. Langflow servers usually hold the API keys for every model and tool their flows call, so code execution on one tends to hand over OpenAI, Anthropic, database and SaaS credentials along with the box.

Lower risk, but not zero:

• A langflow run session bound to 127.0.0.1 on your own laptop. The no-login bugs need network access to the server. Upgrade anyway, because the Agentic Assistant bug (CVE-2026-110193) turns generated component code into commands on whatever machine runs it.
• Instances where only you have an account and auto-login is off. The 9.9 and 8.8 bugs all need an account, so one trusted user removes much of the risk. It does nothing for CVE-2026-93680, CVE-2026-110186 or CVE-2026-104339.
• Deployments with an authenticating reverse proxy (SSO, VPN, IAP) in front of every Langflow path. The attacker has to get through that first.

Not in scope: servers already on 1.13.0. IBM's records start every affected range at 1.0.0, so pre-1.0 releases are not listed, which is not the same as safe. Those builds are long out of support and carry the older KEV bugs below.

What this is not

This is not a known in-the-wild campaign. It is a disclosure of fixes that already shipped: 1.12.4 came out Sep 29, 1.12.5 on Oct 6 and 1.13.0 on Oct 22, and IBM's bulletins are dated Oct 19 and Oct 28. The CVE records only went public today. That gap cuts both ways. Anyone who wanted to diff the releases has had weeks, and a Metasploit module for the auth bypass was public before the CVE record was. If you upgraded to 1.12.8 last week, you are still exposed to the four bugs that run through it.

The critical and high IDs

Scores and ranges come from IBM's CVE records. All affected ranges start at 1.0.0. IBM has published one-line descriptions only, with no endpoint names or proof of concept. The 1.13.0 bulletin summary does say the batch includes "an incomplete remediation of an auto-login security control" and "unauthenticated remote code execution exploitable through model context protocol tool enumeration", without saying which ID is which. The HOL Guard evidence pack for CVE-2026-93680 tracks the source records.

Rotate what Langflow was holding

Four of the medium-rated bugs are about secrets, and an upgrade does not undo any of them:

• CVE-2026-104314: a user with read or share access to a flow could pull the owner's stored third-party credentials in cleartext from the API.
• CVE-2026-77817: flow and project exports did not strip secrets. IBM's bulletin says plainly that upgrading only fixes new exports. Any JSON export made on an affected version and now sitting in a repo, a ticket or a Slack thread may carry live keys.
• CVE-2026-110192 (through 1.12.8) and CVE-2026-110200 (through 1.12.4): insufficiently protected and cleartext-stored credentials.

If the server was ever reachable by people you do not fully trust, rotate the model and tool API keys saved in Langflow's global variables after the upgrade, and search your repos for exported flow files.

If you cannot upgrade today

IBM's 1.13.0 bulletin lists no workaround for the four bugs that run through 1.12.8. The steps below cut exposure. They do not fix anything.

• Take port 7860 off the internet. Bind to 127.0.0.1 or put an authenticating proxy in front of every path, including /api/.
• Turn off auto-login (LANGFLOW_AUTO_LOGIN=false with a superuser password) so the authenticated bugs need a real account.
• Set LANGFLOW_ENABLE_SIGNUP=false so strangers cannot register themselves.
• If you use MCP stdio servers, IBM's 1.12.5 bulletin recommends LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true, then a restart. Keep LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS unset.
• If your deployment uses a message broker, make sure nothing outside the deployment can reach it (CVE-2026-104317).

Langflow has been hit before

CISA's Known Exploited Vulnerabilities catalog already lists six Langflow CVEs, starting with CVE-2025-3248, the unauthenticated code execution in /api/v1/validate/code added on May 5, 2025 and marked as known to be used in ransomware campaigns. The others are CVE-2026-33017 (Mar 25), CVE-2025-34291 (May 21), CVE-2026-55255 (Jul 7), CVE-2026-0770 (Jul 21) and CVE-2026-9198 (Aug 4). Internet-facing Langflow servers have been a repeat target, so expect more scanning now that the IDs are public.

What do people ask about the Langflow CVE batch?

Which Langflow version fixes CVE-2026-93680 and CVE-2026-110186?

Langflow 1.13.0, released Oct 22, 2026. IBM lists Langflow OSS 1.0.0 through 1.12.8 as affected and there is no fixed 1.12.x release.

Are the Langflow CVEs from Oct 29, 2026 being exploited?

We found no report of in-the-wild exploitation as of 11:50 AM ET on Oct 29, 2026, and none of the 33 is in the CISA KEV catalog. A public Metasploit module exists for CVE-2026-93680. Six older Langflow CVEs are in KEV, including CVE-2025-3248.

Do I need a Langflow account to exploit these bugs?

For CVE-2026-93680, CVE-2026-110186 and CVE-2026-104339, no. Most of the others need an account, but on a 1.12.x install with auto-login on, every visitor is signed in automatically.

Why does Langflow fail to start after upgrading to 1.13.0?

1.13.0 disables auto-login by default and requires a superuser password. Set LANGFLOW_SUPERUSER_PASSWORD, and if the old instance used auto-login, follow the Recover access after upgrading steps in the Langflow docs.

Why is IBM publishing Langflow CVEs?

IBM acquired DataStax, which owns Langflow, and IBM's PSIRT now assigns and publishes Langflow CVEs through IBM security bulletins.

References

• IBM security bulletin 7294467: Langflow OSS 1.0.0 to 1.12.8, fixed in 1.13.0
• IBM security bulletin 7293016: Langflow OSS 1.0.0 to 1.12.4, fixed in 1.12.5
• IBM security bulletin 7293015: Langflow OSS 1.0.0 to 1.12.3, fixed in 1.12.4
• CVE-2026-93680 on cve.org
• CVE-2026-110186 on cve.org
• Langflow v1.13.0 release notes
• langflow-ai/langflow PR 14993: disable automatic login by default
• langflow-ai/langflow PR 15789: recovery after upgrading from an auto-login installation
• Rapid7: Metasploit Wrap Up, Oct 23, 2026 (Langflow modules)
• Metasploit module: langflow_auth_bypass_cve_2026_93680
• langflow 1.13.0 on PyPI
• CISA Known Exploited Vulnerabilities catalog