Langflow CVE-2026-93680 scores 9.8 before version 1.13.0

IBM’s October 28 bulletin, updated the next day, lists four flaws in Langflow, the open-source builder for AI agents and workflows. Vulnerability reports for the project go to IBM. Two of the flaws need no account and score 9.8 on IBM’s scale. CVE-2026-93680 is an authentication failure that can bypass the product’s security checks. CVE-2026-110186 is a code-generation failure that can run an attacker’s code on the server. Every release from 1.0.0 through 1.12.8 carries both. The release that clears them is 1.13.0. IBM’s bulletin gives one remediation: that version.

CISA’s Known Exploited Vulnerabilities catalog, as of its October 30 update, omits both identifiers. The catalog already holds six older Langflow entries. The newest of those, CVE-2026-9198, was added in August. A Langflow listener on the internet already sits in the set those earlier entries describe. These two scores put that server on 1.13.0 this week.

What the bulletin assigns to each flaw

CVE-2026-93680, critical, 9.8. No account. Improper authentication. IBM says a remote caller can bypass security restrictions.

CVE-2026-110186, critical, 9.8. No account. Improper control of code generation. IBM says a remote caller can run arbitrary code.

CVE-2026-110193, high, 8.8. A low-privileged account is enough. IBM says the Agentic Assistant can be driven to produce or submit component code that runs operating-system commands on the host.

CVE-2026-110192, medium, 6.5. An account is required. IBM says the product can return sensitive information from credentials that were left insufficiently protected.

Langflow can offer its flows as tools to other AI applications over the Model Context Protocol. IBM associates one of the unauthenticated flaws with that exposure. The bulletin also describes one issue as an incomplete repair of the automatic-login control. In 1.12.8 that control ships enabled, and the product’s own note says it skips sign-in and belongs in a development environment. Version 1.13 leaves automatic login off unless an operator turns it on. IBM’s bulletin leaves open whether disabling automatic login, by itself, clears the four flaws. The version line is the control.

Public scanning tooling already cites CVE-2026-93680. One published affected range, 1.5.0 through 1.11.4, is narrower than IBM’s 1.0.0 through 1.12.8. Inventory against IBM’s range.

1.12.8 and 1.13.0 shipped the same day

Langflow 1.13.0 was released on October 22. So was 1.12.8, and 1.12.8 still contains the four flaws. As of November 2, the Python package index showed no later 1.12 build. The newest build on the 1.12 line stays on the vulnerable side of the bulletin.

On October 29 IBM also published records for 29 further Langflow flaws and named 1.12.4 and 1.12.5 as the releases that fix that earlier set. One of them, CVE-2026-104339, is another unauthenticated code-execution issue scored 9.8. Across all 33 records, including the four in last week’s bulletin, 1.13.0 sits outside the affected list. One upgrade covers both waves. A host parked on an early 1.12 build is still carrying CVE-2026-104339.

What to do with a running server

Find every Langflow process: analyst laptops, lab VMs, cluster jobs, and any product that embedded the package. If the listener is reachable past the loopback address, remove it from the open internet before the maintenance window, then move it to 1.13.0.

Back up the database, the secret key, and uploaded files before the upgrade. Where automatic login is on, give the existing account a password so operators can sign in after 1.13.0 boots. The project’s upgrade notes warn that deleting the installation to recover a login can erase the flows. Follow the recovery steps those notes link, and keep the data directory.

For container deploys, the fixed image is langflowai/langflow:1.13.0. Keep the volume that holds flows and secrets. After the rollout, read the version back from the running process. A tag named latest can still resolve to 1.12.8.

Rotate model keys, API tokens, and other credentials the flows stored, on any server that was reachable before the upgrade. CVE-2026-110192 is the credential issue in this bulletin. The unauthenticated pair is the reason to assume a reachable server was open to anyone who could find it.

Langflow’s reports go to IBM, and IBM’s instruction is a version number. 1.13.0 is that number.

This briefing relies on public reporting by The Hacker News and on IBM’s Langflow security bulletin. It does not include exploit procedures or proof-of-concept detail.