{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-F73A68AD",
  "slug": "cve-2026-93680-langflow-auth-bypass-rce-upgrade-1-13-0",
  "title": "Langflow OSS 33-CVE disclosure: no-login auth bypass and code execution through 1.12.8 (CVE-2026-93680, CVE-2026-110186), fixed in 1.13.0",
  "aliases": [
    "CVE-2026-93680",
    "CVE-2026-110186",
    "CVE-2026-104339",
    "CVE-2026-107327",
    "CVE-2026-107328",
    "CVE-2026-107329",
    "CVE-2026-110193",
    "Langflow 1.13.0",
    "Langflow OSS is affected by multiple vulnerabilities",
    "Langflow auth bypass",
    "Langflow unauthenticated RCE",
    "Langflow MCP SSE auth bypass",
    "IBM Langflow security bulletin"
  ],
  "summary": "On 2026-10-29 between 15:14 and 15:19 UTC, IBM (the CNA for Langflow) published 33 CVE records for Langflow OSS, backed by three IBM security bulletins dated 2026-10-19 (nodes 7293015 and 7293016) and 2026-10-28 (node 7294467). Four IDs affect every release from 1.0.0 through 1.12.8 and are fixed only in 1.13.0 (released 2026-10-22): CVE-2026-93680 (9.8, improper authentication, no login), CVE-2026-110186 (9.8, code execution via improper control of code generation, no login), CVE-2026-110193 (8.8, a low-privileged user makes the Agentic Assistant generate or submit component code that runs OS commands) and CVE-2026-110192 (6.5, insufficiently protected credentials). Sixteen IDs through 1.12.3 are fixed in 1.12.4, including the unauthenticated CVE-2026-104339 (9.8) and message-broker deserialization CVE-2026-104317 (8.1). Thirteen through 1.12.4 are fixed in 1.12.5, including three authenticated 9.9 code-execution bugs (CVE-2026-107327, 107328, 107329). Release builds of 1.12.x default LANGFLOW_AUTO_LOGIN to true, which signs visitors in as the bootstrap superuser, so account-required bugs are reachable by anyone who can open the UI on a default install. Langflow 1.13.0 turns auto-login off by default and requires a superuser password. A Metasploit auxiliary module for CVE-2026-93680 (released 2026-10-23) opens the MCP SSE endpoint at /api/v1/mcp/sse without credentials; the module lists 1.5.0 through 1.11.4.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "IBM published one-line descriptions with no endpoint names or proof of concept, and its 1.13.0 bulletin summary does not map its themes (incomplete auto-login remediation, MCP tool enumeration RCE, API key exposure, Agentic Assistant code execution) to specific IDs. The Metasploit module lists 1.5.0 through 1.11.4 for CVE-2026-93680 while IBM lists 1.0.0 through 1.12.8. No in-the-wild exploitation of any of the 33 had been reported and none was in CISA KEV (catalog 2026.10.28) as of 2026-10-29 15:50 UTC. CVSS scores are IBM's.",
  "firstObservedAt": "2026-10-22T21:20:16Z",
  "lastObservedAt": "2026-10-29T15:48:15Z",
  "publishedAt": "2026-10-29T15:59:41.178Z",
  "reviewedAt": "2026-10-29T15:59:35.581Z",
  "expiresAt": "2026-10-29T15:48:15Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "ibm-7294467",
      "label": "IBM Security Bulletin 7294467: Langflow OSS 1.0.0-1.12.8, fixed in 1.13.0",
      "url": "https://www.ibm.com/support/pages/node/7294467",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-28T00:00:00Z"
    },
    {
      "id": "ibm-7293016",
      "label": "IBM Security Bulletin 7293016: Langflow OSS 1.0.0-1.12.4, fixed in 1.12.5",
      "url": "https://www.ibm.com/support/pages/node/7293016",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-19T00:00:00Z"
    },
    {
      "id": "ibm-7293015",
      "label": "IBM Security Bulletin 7293015: Langflow OSS 1.0.0-1.12.3, fixed in 1.12.4",
      "url": "https://www.ibm.com/support/pages/node/7293015",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-19T00:00:00Z"
    },
    {
      "id": "cve-93680",
      "label": "CVE-2026-93680 CVE record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93680",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-29T15:18:37Z"
    },
    {
      "id": "cve-110186",
      "label": "CVE-2026-110186 CVE record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110186",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-29T15:15:59Z"
    },
    {
      "id": "gh-release-1130",
      "label": "langflow-ai/langflow v1.13.0 release notes",
      "url": "https://github.com/langflow-ai/langflow/releases/tag/v1.13.0",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-22T21:20:30Z"
    },
    {
      "id": "gh-pr-14993",
      "label": "langflow-ai/langflow PR 14993: disable automatic login by default",
      "url": "https://github.com/langflow-ai/langflow/pull/14993",
      "sourceType": "other_primary",
      "observedAt": "2026-09-29T18:47:13Z"
    },
    {
      "id": "gh-pr-15789",
      "label": "langflow-ai/langflow PR 15789: guide recovery after upgrading from an auto-login installation",
      "url": "https://github.com/langflow-ai/langflow/pull/15789",
      "sourceType": "other_primary",
      "observedAt": "2026-10-16T20:44:27Z"
    },
    {
      "id": "pypi-langflow",
      "label": "langflow 1.13.0 on PyPI",
      "url": "https://pypi.org/project/langflow/1.13.0/",
      "sourceType": "other_primary",
      "observedAt": "2026-10-22T21:20:16Z"
    },
    {
      "id": "rapid7-wrapup",
      "label": "Rapid7: Metasploit Wrap Up: Langflow, MongoDB, and More",
      "url": "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more/",
      "sourceType": "research",
      "observedAt": "2026-10-23T00:00:00Z"
    },
    {
      "id": "msf-module",
      "label": "Metasploit module langflow_auth_bypass_cve_2026_93680",
      "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/langflow_auth_bypass_cve_2026_93680.rb",
      "sourceType": "research",
      "observedAt": "2026-10-08T20:07:54Z"
    },
    {
      "id": "cisa-kev",
      "label": "CISA Known Exploited Vulnerabilities catalog",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "sourceType": "government",
      "observedAt": "2026-10-28T19:00:04Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: Langflow CVE-2026-93680 and 32 more bugs, upgrade to 1.13.0",
      "url": "https://hol.org/blog/cve-2026-93680-langflow-auth-bypass-rce-upgrade-1-13-0",
      "sourceType": "other_primary",
      "observedAt": "2026-10-29T15:48:15Z"
    }
  ],
  "artifacts": [
    {
      "id": "langflow-pypi",
      "artifactClass": "package",
      "ecosystem": "pypi",
      "name": "langflow",
      "version": ">=1.0.0, <=1.12.8 affected; fixed in 1.13.0 (subsets fixed in 1.12.4 and 1.12.5)",
      "defanged": false
    },
    {
      "id": "langflow-docker",
      "artifactClass": "package",
      "ecosystem": "docker",
      "name": "langflowai/langflow",
      "version": "tags 1.0.0 through 1.12.8 affected; 1.13.0 fixed",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "langflow-1-12-4-release",
      "occurredAt": "2026-09-29T20:13:45Z",
      "eventType": "vendor_action",
      "summary": "Langflow 1.12.4 ships to PyPI; IBM later lists it as the fix for 16 of the 33 IDs.",
      "sourceIds": [
        "pypi-langflow",
        "ibm-7293015"
      ]
    },
    {
      "id": "langflow-1-12-5-release",
      "occurredAt": "2026-10-06T20:08:52Z",
      "eventType": "vendor_action",
      "summary": "Langflow 1.12.5 ships; IBM lists it as the fix for 13 more IDs including three 9.9 authenticated RCEs.",
      "sourceIds": [
        "pypi-langflow",
        "ibm-7293016"
      ]
    },
    {
      "id": "langflow-1-13-0-release",
      "occurredAt": "2026-10-22T21:20:16Z",
      "eventType": "vendor_action",
      "summary": "Langflow 1.13.0 ships with automatic login disabled by default; it is the only release fixing the four IDs that run through 1.12.8.",
      "sourceIds": [
        "gh-release-1130",
        "pypi-langflow",
        "ibm-7294467"
      ]
    },
    {
      "id": "metasploit-module-release",
      "occurredAt": "2026-10-23T00:00:00Z",
      "eventType": "other",
      "summary": "Rapid7's Metasploit wrap-up announces an auxiliary module for CVE-2026-93680 that initializes MCP sessions over /api/v1/mcp/sse without credentials.",
      "sourceIds": [
        "rapid7-wrapup",
        "msf-module"
      ]
    },
    {
      "id": "ibm-disclosure",
      "occurredAt": "2026-10-29T15:14:49Z",
      "eventType": "disclosure",
      "summary": "IBM publishes 33 Langflow OSS CVE records to the CVE List referencing bulletins 7293015, 7293016 and 7294467.",
      "sourceIds": [
        "cve-93680",
        "cve-110186",
        "ibm-7294467"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-10-29T15:48:15Z",
      "eventType": "other",
      "summary": "HOL publishes operator guidance: upgrade path, auto-login lockout recovery, version and MCP endpoint checks, triage table and credential rotation.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-langflow-server",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not patch or inspect Langflow servers; the fix is upgrading to Langflow 1.13.0 and restricting network access."
    }
  ],
  "policies": [],
  "limitations": [
    "Servers already running Langflow 1.13.0 are not affected by any of the 33 IDs",
    "Instances bound to 127.0.0.1 are not reachable by the no-login network bugs, though the Agentic Assistant issue still applies to anyone using it",
    "Instances with auto-login off and only trusted accounts remove most of the account-required risk but not CVE-2026-93680, CVE-2026-110186 or CVE-2026-104339",
    "Deployments behind an authenticating proxy covering every Langflow path require the attacker to pass that layer first",
    "Releases before 1.0.0 are not listed by IBM, which does not mean they are safe; they carry older KEV-listed bugs"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-93680-langflow-auth-bypass-rce-upgrade-1-13-0/corrections"
}