Langflow: four flaws, two scored 9.8, fixed in 1.13.0

01What happened

IBM published a security bulletin for Langflow OSS on October 28, 2026 and updated it the next day, naming four flaws in versions 1.0.0 through 1.12.8. Langflow had already shipped the fixes in release 1.13.0 on October 22, whose notes mention disabling automatic login by default and blocking unsafe module reexports in assistant code scanning, without CVE ids. IBM's bulletin supplies the ids and the scores.

02How it works

Two of the four flaws need no account. CVE-2026-110186 is an improper control of code generation that IBM scores 9.8, and CVE-2026-93680 is an authentication bypass IBM describes as an incomplete fix for an auto-login control, also 9.8. The other two need a low-privileged account: CVE-2026-110193 lets the Agentic Assistant generate or submit component code using patterns that were not blocked, reaching OS command execution on the server, and CVE-2026-110192 exposes operator-injected API keys.

03Who is affected

Langflow OSS 1.0.0 through 1.12.8 on Windows, Linux and macOS are affected. IBM states that no workarounds or mitigations are available, so an instance stays exposed until it is upgraded. The bulletin also lists three Hono dependency flaws, fixed in Hono 4.13.5.

04What to do

Upgrade to Langflow OSS 1.13.0, which IBM strongly recommends and offers as the only remedy, using pip install --upgrade "langflow==1.13.0" or the langflowai/langflow:1.13.0 image. IBM says to back up the database, secret key and uploaded files first, and to prepare existing accounts for password sign-in if the instance used automatic login.

Questions people ask

Which Langflow versions are affected and which release fixes them?

IBM's bulletin lists Langflow OSS 1.0.0 through 1.12.8 on Windows, Linux and macOS as affected, and directs users to upgrade to 1.13.0. IBM states that no workarounds or mitigations are available for the four flaws. Langflow published the 1.13.0 release on October 22, 2026, six days before IBM's bulletin appeared.

Does an attacker need a Langflow account to exploit these flaws?

Not for all four. IBM scores CVE-2026-110186, an improper control of code generation, at 9.8 with no privileges required, and CVE-2026-93680, an authentication bypass tied to an incomplete auto-login fix, also at 9.8 with no privileges required. The Agentic Assistant code injection CVE-2026-110193 and the credential exposure CVE-2026-110192 both need a low-privileged account.

How do these compare with the Langflow MCP flaw exploited in the wild?

The earlier Langflow issue was an authenticated command execution flaw in the MCP stdio transport, which attackers were seen using against exposed instances. IBM's October bulletin covers four different flaws, two of which need no account at all and score 9.8. Because Langflow has already attracted in-the-wild exploitation, upgrading exposed instances to 1.13.0 is the priority.

Who is credited with finding the Langflow flaws?

Nobody is named. The acknowledgement section of IBM's security bulletin is blank, and the Langflow repository carries no GitHub Security Advisory for these four CVEs. IBM's Product Security Incident Response Team supplied the CVSS 3.1 scores that NVD records for them, which makes IBM's own security team the only identifiable party behind the disclosure.

Sources 2 links, all fetched

1. 1ibm.comIBM Security Bulletin
2. 2github.comLangflow 1.13.0 Release