Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
AI-summarised brief · reviewed before publication
IBM disclosed four critical vulnerabilities affecting every Langflow release from version 1.0.0 through 1.12.8, allowing unauthenticated attackers to bypass authentication or execute arbitrary code on servers. One flaw exploits the Model Context Protocol (MCP) to enumerate tools without credentials, while another stems from the default‑enabled LANGFLOW_AUTO_LOGIN setting, which logs users in as superusers without prompting. The vulnerabilities are catalogued as CVE‑2026‑93680 and related IDs, with a Metasploit module already demonstrating the authentication bypass. IBM’s advisory, first issued on October 28 and updated the next day, notes that only version 1.13.0, released on October 22, resolves the issues by disabling auto‑login by default. No workaround is provided for systems unable to upgrade, and the flaws are not listed in CISA’s Known Exploited Vulnerabilities database.
💡 Why It Matters
- · Unpatched Langflow servers can become footholds for attackers to control AI workflows, exposing enterprises that rely on the tool to data theft and malicious model manipulation.
