EN PT-BR
← Voltar ao feed
critical

Langflow flaws allow unauthenticated auth bypass and RCE in versions 1.0.0 to 1.12.8; fixed in 1.13.0

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 08:50 · coletado há 1 hora

IBM disclosed two critical flaws in the open-source AI workflow tool Langflow that let a remote attacker with no account bypass authentication or run arbitrary code. Every release from 1.0.0 through 1.12.8 is affected, and the only fix is 1.13.0, released on October 22. Neither flaw is in CISA's KEV catalog as of the October 30 update, but a public Metasploit Framework module already cites CVE-2026-93680, the authentication bypass. IBM offers no workaround for servers that cannot upgrade.

Entenda a falha

A vulnerabilidade

Langflow, the open-source AI workflow builder, has two critical flaws. CVE-2026-93680 is an authentication bypass reachable through the MCP endpoint. IBM's bulletin also lists an unauthenticated remote code execution through model context protocol tool enumeration and an incomplete remediation of an auto-login security control. A remote attacker with no account can bypass authentication or run arbitrary code. IBM says every release from 1.0.0 through 1.12.8 is affected and the only fix is 1.13.0, with no workaround. Separately, CVE-2026-104339 (rated 9.8) could also allow unauthenticated arbitrary code execution, but IBM's records name 1.12.4 and 1.12.5 as its fixes.

Como funciona

Langflow can offer its flows as tools to AI apps through the Model Context Protocol (MCP). A client connects to the server's MCP endpoint, starts a session and asks which tools are available. In the Metasploit module for CVE-2026-93680, this happens without credentials and the server answers with its tool list. With LANGFLOW_AUTO_LOGIN enabled, Langflow logs users in as superusers without a sign-in prompt, which is the context the module was tested in. The articles do not describe the step where the code execution flaw runs code, and the bulletin does not say whether servers with automatic login off are vulnerable.

Por que é vulnerável

The articles point to a flawed authentication control around automatic login and the MCP endpoint. IBM describes one flaw as an incomplete remediation of an auto-login security control, meaning an earlier fix did not fully close the problem. LANGFLOW_AUTO_LOGIN logs users in as superusers, and its code description warns it bypasses authentication and should only be used in development, yet it is enabled by default in 1.12.8. Version 1.13.0 turns automatic login off by default. The articles do not explain why the flaws went unnoticed or detail the code change behind the fix.

Onde está

The articles name the Langflow MCP endpoint and the LANGFLOW_AUTO_LOGIN setting, but no file, function or commit.

Como foi descoberta

The articles do not say who found the flaws or how. Langflow's vulnerability reports go to IBM, which published a bulletin on October 28, updated on October 29, listing four Langflow flaws. On October 29 IBM also published CVE records for 29 other Langflow flaws. Version 1.13.0 was released on October 22, and Hacker News reported on November 2 that neither flaw was in CISA's KEV catalog as of the October 30 update.

PoC pública

A module in the public Metasploit Framework cites CVE-2026-93680. It connects to a Langflow server's MCP endpoint without credentials, starts a session and lists the tools offered, but does not run code or commands, so it is a verification-level tool rather than a working code execution exploit. Its author lists 1.5.0 through 1.11.4 as affected, narrower than IBM's range, and tested it on 1.8.4 with automatic login enabled. Since unauthenticated access is already demonstrable publicly and there is no workaround, upgrading to 1.13.0 is urgent.

Publicada em: thehackernews.com/2026/11/critical-langflow-flaws-could-let.html ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 11:16.

Detalhes técnicos

  • IBM's bulletin (first published October 28, updated October 29) lists four Langflow flaws. One is described as "unauthenticated remote code execution exploitable through model context protocol tool enumeration". Another is "an incomplete remediation of an auto-login security control".
  • The Metasploit module for CVE-2026-93680 connects to a Langflow server's MCP endpoint without credentials, starts a session and lists the tools offered. It does not execute code or commands. Its author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM's, and tested it on 1.8.4 with automatic login enabled.
  • With LANGFLOW_AUTO_LOGIN enabled, Langflow logs users in as superusers without a sign-in prompt. The setting is enabled by default in 1.12.8. The bulletin does not say whether servers with automatic login off are vulnerable.
  • Version 1.12.8 was released the same day as 1.13.0 and still has the flaws. PyPI lists no later 1.12 release as of November 2.
  • On October 29, IBM also published CVE records for 29 other Langflow flaws, fixed in 1.12.4 and 1.12.5. One of them, CVE-2026-104339, could also allow unauthenticated arbitrary code execution and is rated 9.8. None of the 33 records lists 1.13.0 as affected.
  • Six other Langflow flaws are in the KEV catalog, the most recent being CVE-2026-9198, added in August.

Remediação

  • Upgrade to Langflow 1.13.0, which turns automatic login off by default: pip install --upgrade "langflow==1.13.0", or the langflowai/langflow:1.13.0 Docker image while keeping persistent data.
  • Before upgrading, back up the database, the secret key and uploaded files. If the server uses automatic login, prepare the existing account for password sign-in per Langflow's upgrade guidance.
  • If you cannot sign in after upgrading, follow the recovery steps in that guidance. Do not delete or reinstall Langflow, as this can permanently remove flows.

Linha do tempo

  1. thehackernews.com ↗ · pub. 02/11/2026 08:50 · coletado 02/11 11:00 primeiro registro

    Langflow flaws allow unauthenticated auth bypass and RCE in versions 1.0.0 to 1.12.8; fixed in 1.13.0

    ler a análise desta fonte

    IBM disclosed two critical flaws in the open-source AI workflow tool Langflow that let a remote attacker with no account bypass authentication or run arbitrary code. Every release from 1.0.0 through 1.12.8 is affected, and the only fix is 1.13.0, released on October 22. Neither flaw is in CISA's KEV catalog as of the October 30 update, but a public Metasploit Framework module already cites CVE-2026-93680, the authentication bypass. IBM offers no workaround for servers that cannot upgrade.

    Technical Details

    • IBM's bulletin (first published October 28, updated October 29) lists four Langflow flaws. One is described as "unauthenticated remote code execution exploitable through model context protocol tool enumeration". Another is "an incomplete remediation of an auto-login security control".
    • The Metasploit module for CVE-2026-93680 connects to a Langflow server's MCP endpoint without credentials, starts a session and lists the tools offered. It does not execute code or commands. Its author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM's, and tested it on 1.8.4 with automatic login enabled.
    • With LANGFLOW_AUTO_LOGIN enabled, Langflow logs users in as superusers without a sign-in prompt. The setting is enabled by default in 1.12.8. The bulletin does not say whether servers with automatic login off are vulnerable.
    • Version 1.12.8 was released the same day as 1.13.0 and still has the flaws. PyPI lists no later 1.12 release as of November 2.
    • On October 29, IBM also published CVE records for 29 other Langflow flaws, fixed in 1.12.4 and 1.12.5. One of them, CVE-2026-104339, could also allow unauthenticated arbitrary code execution and is rated 9.8. None of the 33 records lists 1.13.0 as affected.
    • Six other Langflow flaws are in the KEV catalog, the most recent being CVE-2026-9198, added in August.

    Remediation

    • Upgrade to Langflow 1.13.0, which turns automatic login off by default: pip install --upgrade "langflow==1.13.0", or the langflowai/langflow:1.13.0 Docker image while keeping persistent data.
    • Before upgrading, back up the database, the secret key and uploaded files. If the server uses automatic login, prepare the existing account for password sign-in per Langflow's upgrade guidance.
    • If you cannot sign in after upgrading, follow the recovery steps in that guidance. Do not delete or reinstall Langflow, as this can permanently remove flows.