Cybersecurity
IBM flags Langflow flaws in versions 1.0.0 to 1.12.8
IBM said two critical Langflow vulnerabilities could let unauthenticated attackers bypass login or run code, and it said version 1.13.0 was the only fix for releases 1.0.0 through 1.12.8.
- IBM said in a bulletin published on 28 October and updated on 29 October that Langflow had four flaws, including two it rated critical.
- IBM said versions 1.0.0 through 1.12.8 were affected and that 1.13.0 was the only fixed release.
- One of the critical issues could allow remote code execution without authentication through model context protocol tool enumeration.
- CISA's Known Exploited Vulnerabilities catalog did not list either of the two critical flaws as of 30 October, although six other Langflow issues were already listed there.
- IBM later published 29 more Langflow CVE records on 29 October, and none of the 33 records named 1.13.0 as affected.
IBM said on 28 October, and updated the next day, that it had recorded four Langflow flaws. It said two of them were critical, and that releases from 1.0.0 through 1.12.8 were exposed.
One of the issues allowed unauthenticated remote code execution through enumeration of tools exposed over the Model Context Protocol. IBM said Langflow presented its flows as tools to AI applications that supported that protocol.
A public Metasploit Framework module had already referenced CVE-2026-93680, which IBM identified as the authentication bypass. The module connected to a Langflow MCP endpoint without credentials, opened a session and listed the available tools, but it did not execute code or commands.
IBM said automatic login was enabled by default in Langflow 1.12.8, and that one of the four flaws was an incomplete fix for that control. It did not say whether systems with automatic login disabled were affected.
Langflow 1.13.0 was released on 22 October and disabled automatic login by default. IBM said it had no workaround for servers that could not upgrade yet, and on 29 October it published 29 further Langflow CVE records, none of which marked 1.13.0 as affected.
Named in this story
Companies
- IBM
- published the vulnerability bulletin
Governments and agencies
- Cybersecurity and Infrastructure Security Agency
- maintained the Known Exploited Vulnerabilities catalog
Products and systems
- Langflow
- was the affected open-source tool
- Metasploit Framework
- had a module that cited one of the CVEs
- Model Context Protocol
- provided the interface used in the exploit path
How the source tells it
The article read as a plain security advisory and did not lean on emotive framing.
No emotive framing was found in the original.