Critical Langflow Flaws Let Attackers With No Account Bypass Login or Run Code

IBM has disclosed two critical flaws in Langflow, an open-source tool for building AI agents and workflows. A remote attacker with no account could use them to bypass authentication or run arbitrary code on a server. Every release from 1.0.0 through 1.12.8 is affected, and the only fix is version 1.13.0. IBM offers no workaround for servers that cannot upgrade yet. One flaw is described as unauthenticated remote code execution exploitable through the Model Context Protocol (MCP), which lets Langflow offer its flows as tools to AI apps.

Neither flaw is in CISA's Known Exploited Vulnerabilities catalog as of its October 30 update. However, a module in the public Metasploit Framework already cites the authentication bypass, CVE-2026-93680. It connects to a server's MCP endpoint without credentials and lists the tools on offer, but it does not run code. It was tested with automatic login turned on. That setting, LANGFLOW_AUTO_LOGIN, logs users in as superusers and is enabled by default in version 1.12.8. Another flaw in IBM's bulletin is an incomplete fix of an auto-login security control, and the bulletin does not say whether servers with it turned off are vulnerable.

Version 1.13.0 was released on October 22 and turns automatic login off by default. Version 1.12.8 came out the same day and still has the flaws. IBM also published records for 29 other Langflow flaws on October 29, including CVE-2026-104339, a 9.8-rated flaw that could also allow code execution without an account.