Langflow 1.13.0 fixes two critical flaws allowing unauthenticated code execution
Langflow administrators should upgrade to version 1.13.0 after IBM reported two critical flaws affecting every release from 1.0.0 through 1.12.8. IBM said the flaws can let a remote attacker without an account bypass authentication or run arbitrary code. IBM’s bulletin was first published on October 28 and updated the next day, while Langflow 1.13.0 was released on October 22.
IBM described one flaw as unauthenticated remote code execution through Model Context Protocol tool enumeration. The report explained that MCP allows Langflow to offer its flows as tools to AI applications that support the protocol. A Metasploit module already cites CVE-2026-93680, the authentication bypass, and connects to a Langflow MCP endpoint without credentials to list available tools. The module does not run code or commands on the server.
The risk is also affected by Langflow’s automatic-login setting. The report said LANGFLOW_AUTO_LOGIN is enabled by default in version 1.12.8 and can log users in as superusers without prompting for credentials. IBM described another flaw as an incomplete fix for that security control. IBM’s bulletin does not say whether servers with automatic login disabled remain vulnerable.
Neither flaw appeared in CISA’s Known Exploited Vulnerabilities catalog as of its October 30 update, according to the report. The catalog does contain six other Langflow flaws, most recently CVE-2026-9198, which was added in August.
Langflow’s upgrade guidance says administrators should back up the database, secret key and uploaded files before upgrading. Deployments using automatic login should prepare the existing account for password sign-in. The documented package command is pip install –upgrade "langflow==1.13.0"; Docker deployments should use the langflowai/langflow:1.13.0 image while retaining persistent data. The guidance warns against deleting or reinstalling Langflow during account recovery because that can permanently remove flows.
IBM also published records for 29 other Langflow flaws on October 29. One, CVE-2026-104339, could also allow an unauthenticated attacker to run arbitrary code and carries an IBM severity rating of 9.8. The report said none of the 33 records, including the two critical flaws, lists version 1.13.0 as affected.