Critical Langflow Flaws Expose Servers to Unauthenticated Code Execution

IBM disclosed multiple vulnerabilities in Langflow OSS that could expose servers to authentication bypass and arbitrary code execution. The latest disclosure covers four flaws, including two rated critical, affecting versions 1.0.0 through 1.12.8 and fixed in 1.13.0. A public Metasploit module for CVE-2026-93680 demonstrates unauthenticated Model Context Protocol (MCP) session creation and tool enumeration, but does not execute server-side code. Neither critical flaw appeared in CISA’s Known Exploited Vulnerabilities catalog as of its October 30 update; that absence does not establish that exploitation has not occurred.

An earlier IBM bulletin identified 16 vulnerabilities affecting versions 1.0.0 through 1.12.3, with fixes in 1.12.4. These include CVE-2026-104339, an unauthenticated remote code execution flaw rated CVSS 9.8, and CVE-2026-104317, which can allow unauthenticated code execution when an attacker can reach the message broker. Other issues involve SSRF, access controls, credential exposure, file handling, and denial of service. Administrators should prioritize upgrading to 1.13.0, backing up installations and reviewing release-specific configuration changes. IBM lists no workarounds. Version 1.13.0 also disables automatic login by default, but IBM has not clarified whether disabling it protects earlier releases.