Two serious weaknesses in Langflow, an open-source tool for building AI agents and workflows, could allow a remote attacker with no account to bypass security checks or run code on a server, according to reporting on 2 November 2026 based on an IBM bulletin. The report warns that every release from version 1.0.0 through 1.12.8 is affected, and that version 1.13.0 is the only fix named.

What is affected

The bulletin lists four flaws. The two most serious, CVE-2026-93680 and CVE-2026-110186, are both rated 9.8 out of 10 by IBM. The first is described as improper authentication that could allow security restrictions to be bypassed, while the second involves improper control of code generation that could allow arbitrary code to run. A further high-rated flaw needs a low-privileged account, and a medium-rated flaw could expose sensitive credential information.

Why it matters

Langflow can offer its flows as tools to AI applications through the Model Context Protocol, which makes an internet-facing server a tempting target. The reporting also notes a public Metasploit module referring to the authentication bypass flaw, described as listing tools rather than running code. Neither critical flaw was in CISA's Known Exploited Vulnerabilities catalogue as of its 30 October update, so the report does not claim confirmed exploitation of those two flaws.

What to do

Operators should check which version they are running and plan an upgrade to 1.13.0, backing up their database, secret key and uploaded files first. Version 1.13.0 also turns automatic login off by default; automatic login in 1.12.8 is described as bypassing authentication and suitable only for development use. IBM is reported as offering no workaround for servers that cannot upgrade yet, so affected systems should not be left exposed.

Sources: The Hacker News, 2 November 2026; IBM Langflow bulletin via The Hacker News.