Affected Systems

Langflow versions 1.0.0 through 1.12.8. Two critical flaws (CVE-2026-93680 authentication bypass, CVE-2026-110186 arbitrary code execution) allow unauthenticated remote exploitation. Fixed in version 1.13.0 only. Auto-login feature (enabled by default in 1.12.8) increases exposure.

Exploitation Status

Public Metasploit module exists for CVE-2026-93680 (authentication bypass via MCP endpoint). Module tested on Langflow 1.8.4. No evidence of active exploitation in the wild; flaws not in CISA KEV catalog as of October 30, 2026.

Business Impact

Organizations running Langflow for AI agent workflows face unauthenticated remote code execution risk. Default auto-login configuration in 1.12.8 expands attack surface by granting superuser access without authentication. Exploitation requires no credentials and can lead to full server compromise. Metasploit module availability lowers barrier for attackers to enumerate MCP tools and pivot to code execution.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all Langflow instances to version 1.13.0 using 'pip install --upgrade "langflow==1.13.0"' or Docker image langflowai/langflow:1.13.0
  • Before upgrading, back up database, secret key, and uploaded files; prepare existing accounts for password sign-in if auto-login is enabled
  • Disable LANGFLOW_AUTO_LOGIN on all production instances if upgrade cannot be completed immediately (setting is off by default in 1.13.0)
  • Monitor server logs for unauthorized MCP endpoint access or unexpected tool enumeration activity from unauthenticated sources
  • Audit network exposure of Langflow servers and restrict access to trusted IP ranges or VPN until patching is complete