Langflow: two critical no-login flaws, fixed in version 1.13.0

What happened

Langflow is an open-source visual builder for AI agents and LLM-powered apps. IBM ships it as IBM Langflow OSS. It runs on Windows, Linux and macOS and is installed as a pip package or a Docker container.

On 28 October 2026 IBM published a security bulletin for Langflow OSS 1.0.0 to 1.12.8. It covers four flaws in Langflow itself and three in Hono, a web library bundled with it. The CVE records appeared in NVD on 29 October 2026 and NIST has already analysed them. Slovakia's national CERT (SK-CERT) followed with a critical-severity warning, V20261103-01.

The fix is in version 1.13.0, released on 22 October 2026. IBM states that there is no workaround.

How serious is it?

IBM assigned the scores. For CVE-2026-93680, CISA's SSVC assessment records no exploitation so far, but rates the attack as automatable with total technical impact.

Langflow instances typically hold keys to model providers (OpenAI, Anthropic and others), databases and internal APIs. Whoever takes over the server gets everything its flows connect to.

Technical details

IBM's descriptions are brief. Here is what can be verified from the bulletin and the GitHub release notes:

• CVE-2026-93680 – authentication bypass. IBM ties it to an incomplete fix for the auto-login control (AUTO_LOGIN). With auto-login on, Langflow lets users into the interface without a password. Version 1.13.0 turns it off by default, and the CLI now warns when it is enabled.
• CVE-2026-110186 – code execution. IBM describes weak restrictions on generated code that let a remote attacker run arbitrary code on the server.
• CVE-2026-110193 – Agentic Assistant. A low-privileged authenticated user can get the built-in assistant to generate or submit component code using patterns the filter didn't block, leading to OS command execution on the server. The 1.13.0 release notes mention tighter scanning of assistant code (blocking unsafe module re-exports).
• CVE-2026-110192 – an authenticated attacker can obtain sensitive information because credentials are insufficiently protected.
• Hono library (CVE-2026-84363, -84364, -84365, CVSS 5.3 to 6.5): cache poisoning and stored XSS, a server crash on deeply nested input (default settings not affected) and file writes outside the output directory. All are fixed in Hono 4.13.5.

IBM doesn't explain exactly how each flaw is triggered. As a matter of principle, we don't publish exploitation steps.

Who is affected

IBM lists Langflow OSS 1.0.0 to 1.12.8 on all platforms. Internet-facing installs and those running with auto-login enabled are most at risk. If Langflow comes bundled in another product or platform, ask the vendor which version it ships.

People who only use finished AI services aren't directly affected – whoever runs the Langflow server needs to act.

How to tell if you were compromised

Neither IBM nor SK-CERT has published indicators of compromise. Based on the flaw descriptions, we suggest checking:

• User accounts and API keys in Langflow that nobody on your team created.
• Flows and custom components you don't recognise or that changed recently, especially components with custom code.
• Processes and outbound connections started by the Langflow account or container (shells, script downloads, unknown addresses).
• Access logs: API requests from unfamiliar addresses, particularly if the interface was reachable from the internet.

You can pull addresses and domains out of exported logs with our IOC extractor, which runs entirely in your browser. If you can't rule out compromise, rotate every key and password Langflow held (model providers, databases, cloud) and rebuild the server from a clean install.

What to do

1. Find out the version of every Langflow install (pip show langflow, Docker image tag).
2. Back up the database, secret key and uploaded files – IBM recommends this before upgrading.
3. Upgrade to Langflow 1.13.0 or later (pip install --upgrade "langflow==1.13.0" or the langflowai/langflow:1.13.0 image). The latest release, 1.13.1 from 4 November 2026, adds further security fixes.
4. If you relied on auto-login, set up the account for password sign-in before upgrading, following IBM's instructions. Keep AUTO_LOGIN off afterwards.
5. Don't expose the Langflow interface to the internet – allow access only over a VPN or with authentication at a reverse proxy (our recommendation).
6. Check for signs of compromise as described above, and rotate keys if in doubt.

Timeline

Updates

• 10 November 2026 – first version of this article.