Langflow OSS: four critical flaws, one allows code execution without logging in

What happened

Langflow is an open-source tool for building AI applications such as chatbots, AI agents or search over company documents. You work with it through a web interface where individual steps are wired together into so-called flows. Security bulletins and fixes for Langflow OSS are published by IBM.

On October 28, 2026, IBM published a bulletin about multiple vulnerabilities in versions 1.0.0 through 1.12.8 and updated it on October 29, 2026. The most serious are CVE-2026-110186, which according to IBM lets a remote attacker execute arbitrary code, and CVE-2026-93680, which lets an attacker bypass security restrictions due to improper authentication. NVD published both on October 29, 2026.

Earlier, on October 19, 2026, IBM released a separate bulletin for versions 1.0.0 through 1.12.4. Among other issues it covers CVE-2026-107327 and CVE-2026-107329, which let an attacker with a regular Langflow account run code.

As of this writing, neither IBM nor the US agency CISA reports that attackers are actively exploiting these flaws. The European vulnerability database EUVD run by ENISA lists them as EUVD-2026-113134, EUVD-2026-113155, EUVD-2026-113137 and EUVD-2026-113135, also with no record of exploitation.

Why it is dangerous

Two of the four flaws, CVE-2026-110186 and CVE-2026-107329, are “code injection” bugs (CWE-94), meaning the application does not properly control what code it generates and runs. CVE-2026-93680 is an authentication flaw (CWE-287) and CVE-2026-107327 is a missing authorization check (CWE-862). Picture a cook who prepares whatever is written on an order slip without checking who sent it. If an attacker slips in their own “recipe”, the server will dutifully carry it out.

For CVE-2026-110186 and CVE-2026-93680, IBM’s rating says the attacker needs no login and no user interaction, and the attack works over the network. In the bulletin summary IBM mentions an incomplete fix of the auto-login security control, exposure of API keys without intended authorization, and unauthenticated code execution through MCP (Model Context Protocol) tool enumeration. IBM rates the impact on confidentiality, integrity and availability as high.

CVSS is a 0 to 10 scale that expresses how severe a vulnerability is. Scores of 9 and above mean critical. IBM, as the vendor, rated CVE-2026-110186 and CVE-2026-93680 at 9.8 and CVE-2026-107327 and CVE-2026-107329 at 9.9 under CVSS version 3.1. The latter two require a regular account, but their impact can reach beyond the application itself.

The CISA KEV catalog lists vulnerabilities that the US agency CISA has confirmed are being exploited in the wild. As of this writing, these flaws are not in it. EPSS estimates the probability of exploitation in the next 30 days. No EPSS score is available for these flaws yet. Still, Langflow can store API keys for AI services, and IBM mentions that they may be exposed. Don’t put off the upgrade.

Who is affected

Langflow OSS versions 1.0.0 through 1.12.8 are affected (CVE-2026-110186, CVE-2026-93680). CVE-2026-107327 and CVE-2026-107329 affect versions 1.0.0 through 1.12.4. IBM lists Linux, Windows and Mac OS as platforms.

Langflow typically runs on a company server, a cloud virtual machine or in a Docker container, where developers and analysts use it to build chatbots and AI agents. Installations reachable from the internet are most at risk. A server on the internal network is still exposed to anyone who has already got inside. Don’t forget test installations that someone spun up “just to try it out” and then forgot about.

According to IBM, version 1.13.0 is fixed. Organizations that don’t use Langflow are not affected.

How to check if you are affected

If Langflow runs as a Python package, use this command to find the version. Run it in the same virtual environment where Langflow is installed:

pip show langflow

If it runs in Docker, first list the running containers and their images:

docker ps --format "{{.Names}}  {{.Image}}"

If the image name has no version number (for example the latest tag), check the version inside the container. Replace CONTAINER_NAME with the name from the previous output. The command prints only the version number:

docker exec CONTAINER_NAME python -c "import importlib.metadata as m; print(m.version('langflow'))"

If the version is between 1.0.0 and 1.12.8, the installation is vulnerable. Versions 1.0.0 through 1.12.4 are hit by all four flaws. These commands change nothing, they only read information.

How to fix it

IBM strongly recommends upgrading Langflow OSS to version 1.13.0, which addresses all four critical flaws. Version 1.12.5 only fixes the issues from the October 19, 2026 bulletin, not CVE-2026-110186 or CVE-2026-93680. IBM provides no interim workaround that would replace the upgrade for the newer flaws.

Back up the database, the secret key and uploaded files.
If you use automatic login (auto-login), prepare the existing account for password sign-in as described in IBM’s installation and Docker upgrade instructions.
Read the 1.13.0 release notes.
Python install: upgrade with the command below.
Docker: use the langflowai/langflow:1.13.0 image, pull it and restart the deployment while preserving its persistent data.
After upgrading, check the version again and test your flows.

pip install --upgrade "langflow==1.13.0"

If you use MCP stdio, IBM’s October 19, 2026 bulletin recommends also setting the environment variables LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restarting the service. These settings do not replace the upgrade and may require changes to your MCP server launch configuration. For public flows, keep the default restriction and don’t enable LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS.

Until you can upgrade, a general precaution is to take Langflow off the internet and make it reachable only via VPN or the internal network. This does not replace the upgrade. Work in this order: internet-facing servers first, then internal and test installations.

What if you may already be compromised

IBM’s bulletins do not list specific indicators of compromise. If a vulnerable Langflow instance was reachable from the internet, assume someone may have probed it. Look at:

unknown user accounts in Langflow or unexpected permission changes
new or modified flows and custom components with Python code that nobody on your team created
Langflow and reverse proxy logs, especially unusual requests from unknown IP addresses
unknown processes, new files and unusual outbound connections from the server or container
unusual usage at your AI service providers, which may reveal a stolen API key being abused

If Langflow was vulnerable and internet-facing, rotate all API keys and passwords stored in it. In its October 19, 2026 bulletin, IBM warns about a separate flaw, CVE-2026-77817, fixed in version 1.11.5: credentials in previously exported flows and projects must be revoked or rotated, because upgrading does not remove them from copies already exported. If you find signs of compromise, disconnect the server from the network, don’t delete evidence, and bring in an incident response specialist.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.