Published November 3, 2026 (IST) by the AgentStack News Desk. Facts were checked against IBM’s bulletin 7294467 (updated October 29), the Langflow authentication docs, PyPI release records, and our own lab test of Langflow 1.12.8 and 1.13.0 on November 3.
Every Langflow OSS release from 1.0.0 through 1.12.8 carries two critical 9.8 flaws that need no login, and Langflow 1.13.0 is the only fix, according to IBM’s security bulletin. This Langflow vulnerability starts with an auto-login control that hands out superuser sessions. IBM lists no workaround.
We installed both versions in an isolated lab. One unauthenticated GET request to a default 1.12.8 server returned a superuser token that listed 32 agentic MCP tools, including run_flow and delete_flow. The bigger surprise came after we upgraded.
An API key minted through auto-login on 1.12.8 still worked as superuser after the upgrade to 1.13.0, and so did the old access and refresh tokens. Patching closes the door, but it does not take back the keys. This piece follows our editorial standards.
TL;DR
- What broke: Langflow OSS 1.0.0 to 1.12.8 has two unauthenticated 9.8 flaws, CVE-2026-93680 and CVE-2026-110186, plus an 8.8 and a 6.5.
- The fix: upgrade to Langflow 1.13.0, which turns auto-login off and refuses to start without LANGFLOW_SUPERUSER_PASSWORD. IBM lists no workaround.
- Our test: a default 1.12.8 server gave a superuser token to one anonymous request, and that token listed 32 agentic MCP tools.
- The gap: API keys and tokens taken before the upgrade kept superuser access on 1.13.0 until we deleted the key and rotated LANGFLOW_SECRET_KEY.
- What to do: upgrade, then delete unknown API keys, rotate the secret key, and check for LANGFLOW_AUTO_LOGIN=true overrides.
What IBM Disclosed About Langflow
IBM disclosed four Langflow OSS flaws on October 28 and updated the bulletin on October 29. Two score 9.8 and need no account: an authentication bypass rooted in auto-login and a code injection flaw. A third lets a low-privileged user run OS commands through the Agentic Assistant. Version 1.13.0 fixes all four.
| CVE | Score | Login needed | What IBM describes |
|---|---|---|---|
| CVE-2026-93680 | 9.8 Critical | No | Improper authentication (CWE-287) that bypasses security restrictions |
| CVE-2026-110186 | 9.8 Critical | No | Code injection (CWE-94) that lets a remote attacker run code |
| CVE-2026-110193 | 8.8 High | Low-privileged account | Agentic Assistant generates component code that runs OS commands |
| CVE-2026-110192 | 6.5 Medium | Account | Insufficiently protected credentials (CWE-522) exposing operator-injected API keys |
| CVE-2026-84363, 84364, 84365 | Varies | Varies | Flaws in the bundled Hono library, fixed in Hono 4.13.5 |
IBM’s summary ties the critical pair to an incomplete remediation of an auto-login security control and to remote code execution through MCP tool enumeration. The bulletin credits no finder. PyPI shows 1.12.8 and 1.13.0 were both uploaded on October 22, six days before the bulletin, and there is no 1.12.9.
Rapid7 lists a Metasploit auxiliary module for CVE-2026-93680 that enumerates MCP tools on versions 1.5.0 to 1.11.4, per its module page. The module stops at listing and runs no code. The flaw was not in the CISA KEV catalog at its October 30 update, though an older Langflow bug, CVE-2025-3248, was added in May 2025.
We Tested Langflow 1.12.8 and 1.13.0 in a Lab
A default Langflow 1.12.8 install hands a superuser token to anyone who asks. In our November 3 test, GET /api/v1/auto_login returned HTTP 200 with access, refresh and API key cookies, and whoami reported is_superuser true. With those cookies, the agentic MCP endpoint listed 32 tools.
How we tested: we installed langflow 1.12.8 and 1.13.0 from PyPI in separate virtual environments and bound every server to 127.0.0.1. We sent MCP initialize and tools/list requests to /api/v1/agentic/mcp and called no tool. Each check used a fresh HTTP client with no cookies.
A default 1.13.0 server returned 403 on auto_login and on every MCP endpoint, with the message that an API key must be passed. An explicit LANGFLOW_AUTO_LOGIN=true override on 1.13.0 brought back the full 1.12.8 exposure. With LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true on 1.12.8, the MCP tools and the flows API answered with zero credentials.
The 32 tools cover the whole build loop: create_flow, configure_component, run_flow, build_flow, export_flow, delete_flow and run_assistant, which starts the server side Langflow Assistant. None of the 32 carry MCP tool annotations, so no tool sets readOnlyHint or destructiveHint as the MCP specification defines them.
Why Upgrading Alone Leaves Old Keys Working
Upgrading stops new anonymous sessions, but it leaves credentials an attacker already took. We minted an API key through 1.12.8 auto-login, then upgraded the same database, config directory and secret key to 1.13.0. The old key still returned is_superuser true and listed all 32 agentic MCP tools.
The old access token and refresh token also kept working on 1.13.0, while auto_login itself returned 403. Deleting the API key killed it at once, but both tokens survived that step. Only restarting with a new LANGFLOW_SECRET_KEY made them fail with 401.
Langflow’s own authentication docs say this in one line, and none of the top five search results for these CVEs quote it. Disabling auto-login does not revoke previously issued sessions or API keys.
What Langflow Teams Should Do Now
Teams should upgrade to 1.13.0, then treat any server that was reachable on 1.12.8 or older as exposed. That means deleting API keys nobody can account for, rotating LANGFLOW_SECRET_KEY to kill old tokens, rotating model provider keys stored in Langflow, and removing any LANGFLOW_AUTO_LOGIN=true override from the environment.
- Find every instance: GET /api/v1/version answers without a login on both versions, so one request per host tells you which servers still run 1.12.8 or older.
- Test for the open door: an HTTP 200 from /api/v1/auto_login means anyone can get a superuser session. A 403 is what a patched default server returns.
- Prepare the account first: set a password on the existing superuser before upgrading, because 1.13.0 refuses to start without LANGFLOW_SUPERUSER_PASSWORD. Our in-place upgrade without it failed to boot.
- Revoke after upgrading: delete unknown API keys under Settings, then rotate LANGFLOW_SECRET_KEY with Langflow’s migration script so stored credentials stay readable.
- Close the overrides: remove LANGFLOW_AUTO_LOGIN=true and LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true from .env files, Compose files and Helm values.
- Harden for shared use: set LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true where untrusted users can build flows.
These two checks run from any machine that can reach the server. Replace the host with your own.
# 1. Which version is this host running? (no login needed)
curl -s https://langflow.example.internal/api/v1/version
# 2. Does it still hand out anonymous superuser sessions?
curl -s -o /dev/null -w "%{http_code}\n" https://langflow.example.internal/api/v1/auto_login
# 200 = exposed, upgrade now 403 = auto-login is off
Teams that put Langflow behind an MCP gateway can block /api/v1/auto_login and /api/v1/mcp/ at the edge while they upgrade. Our MCP gateways guide and the best AI agent security tools for runtime protection cover the controls, and our MCP security tools list covers scanners that flag unannotated tools.
Why This Langflow Flaw Matters for Agent Teams
Langflow is a visual builder for agents and flows, so a superuser session reaches every model key, database connection and MCP server the flows use. The agentic MCP endpoint turns that session into tools an AI client can call, so one leaked session reaches every system those flows connect to.
Langflow has been here before: CVE-2025-3248, an unauthenticated code execution bug, reached the CISA KEV list in May 2025. It fits a pattern we tracked in the Black October LLMjacking breaches and the LiteLLM supply chain compromise, where stolen keys outlived the first fix. Our non-human identity tools guide covers how to find and rotate those keys at scale.
Frequently Asked Questions
Which Langflow versions are affected by CVE-2026-93680?
IBM says every Langflow OSS release from 1.0.0 through 1.12.8 is affected, and 1.13.0 is the only fixed version. PyPI lists 1.13.0 as uploaded on October 22, 2026, with no 1.12.9 patch release. IBM lists no workaround, so teams that cannot upgrade should keep the server off the network.
How do I check if my Langflow server is exposed?
Send a GET request to /api/v1/auto_login on the server. An HTTP 200 response with access token cookies means anyone can get a superuser session, which is what our default 1.12.8 install returned. A patched 1.13.0 server with default settings returns 403. GET /api/v1/version also shows the running release without a login.
Does upgrading to Langflow 1.13.0 revoke old sessions?
No. Langflow’s docs say disabling auto-login does not revoke previously issued sessions or API keys. In our lab, an API key and tokens minted on 1.12.8 kept superuser access after the upgrade. Deleting the API key and rotating LANGFLOW_SECRET_KEY were the steps that finally made those old credentials fail.
Why does Langflow 1.13.0 fail to start after the upgrade?
Langflow 1.13.0 requires LANGFLOW_SUPERUSER_PASSWORD when auto-login is off, and startup fails closed with a ValueError if it is missing. Our in-place upgrade of a 1.12.8 auto-login install failed this way. Langflow’s upgrade guide says to set a password on the existing account first, so your flows stay with that account.
Is the Langflow auto-login flaw being exploited?
We found no public report of exploitation as of November 3, 2026, and the flaw was not in the CISA KEV catalog at its October 30 update. A Metasploit module that lists MCP tools on versions 1.5.0 to 1.11.4 is public. An older Langflow flaw, CVE-2025-3248, was exploited and added to KEV in May 2025.
The Bottom Line
Langflow 1.13.0 closes the auto-login hole, and our lab confirms its default setup blocks every anonymous request we tried. The upgrade does not clean up after the hole, though. Treat any 1.12.8 server that was reachable as breached until you delete unknown API keys and rotate the secret key.
We will update this story if IBM revises the bulletin, CISA adds the CVEs to KEV, or a 1.12.x patch appears. Send corrections through our contact page.
Related coverage: FastMCP security advisories, MCP tool security bugs, Google Connected Apps and MCP servers, AI security posture management tools, and our MCP explainer.