Critical Langflow AI Vulnerabilities Allow Hackers to Execute Remote Code Without Authentication

IBM has disclosed seven vulnerabilities in Langflow OSS, including critical flaws such as authentication bypass and code injection that attackers can exploit remotely without credentials. The bulletin addresses Langflow versions 1.0.0 through 1.12.8 and advises administrators to upgrade to version 1.13.0.

According to IBM’s security bulletin, published October 28 and updated October 29, the vulnerabilities could enable arbitrary code execution, API credential exposure, authentication bypass, and attacks involving bundled dependencies. Two vulnerabilities carry CVSS scores of 9.8, indicating low-complexity network exploitation without privileges or user interaction.

Langflow AI Vulnerabilities

CVE-2026-93680 involves improper authentication, allowing remote attackers to bypass security restrictions. IBM’s summary identifies incomplete remediation of an automatic-login security control among the underlying issues. Separately, CVE-2026-110186 permits arbitrary code execution through insufficient control over code generation.

The bulletin also describes unauthenticated remote code execution reachable through Model Context Protocol tool enumeration. However, its individual CVE descriptions do not explicitly map every summarized attack mechanism to a specific identifier. These risks expand the attack surface of vulnerable MCP servers, where external integrations can expose sensitive functionality.

CVE-2026-110193 requires a low-privileged authenticated account. An attacker could cause the Agentic Assistant to generate or submit component code containing unblocked patterns, resulting in operating system command execution on the server. CVE-2026-110192 separately enables authenticated attackers to obtain sensitive information through insufficiently protected credentials.

The distinction matters: not every issue is unauthenticated, and the bulletin does not establish that attackers must chain these vulnerabilities. Langflow’s exposure is particularly consequential because cryptomining attacks against Langflow servers have already exploited a separate, older vulnerability.

CVE Details

IBM lists the following vulnerabilities, including three issues in the Hono framework dependency. Scores are CVSS v3.1 base scores.

CVE	Component	CVSS	Impact
CVE-2026-93680	Langflow	9.8	Unauthenticated authentication bypass
CVE-2026-110186	Langflow	9.8	Unauthenticated arbitrary code execution
CVE-2026-110193	Langflow	8.8	Authenticated server command execution
CVE-2026-110192	Langflow	6.5	Authenticated sensitive-information disclosure
CVE-2026-84363	Hono	5.9	Request interpretation inconsistency; cache poisoning
CVE-2026-84364	Hono	5.3	Memory exhaustion through nested objects
CVE-2026-84365	Hono	6.5	Build-time path traversal

Hono’s cache issue requires infrastructure that preserves literal hash characters in request URLs. Its memory-exhaustion flaw affects endpoints with dot-notation body parsing enabled, which is not the default. The traversal vulnerability affects static-site generation using untrusted route parameters, not ordinary request-time routing. All three are fixed in Hono 4.13.5.

Administrators should upgrade affected installations to Langflow 1.13.0 using pip install –upgrade “langflow==1.13.0” or the Docker image langflowai/langflow:1.13.0. This replace the remediation release associated with another Langflow vulnerability bulletin.

Before upgrading, back up the database, secret key, and uploaded files. Automatic-login deployments must prepare existing accounts for password sign-in. Docker operators should verify persistent storage before recreating containers, since a misconfigured deployment can lose its database and credentials. IBM provides no separate interim workaround.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.