What happened
IBM published (bulletin updated 2026-10-29) a set of Langflow OSS defects affecting every release 1.0.0–1.12.8, including two unauthenticated CVSS 9.8 flaws: CVE-2026-93680 (improper authentication / automatic-login bypass via the MCP endpoint) and CVE-2026-110186 (improper control of code generation enabling unauthenticated RCE through MCP tool enumeration). A public Metasploit module already targets the authentication bypass. These were freshly surfaced to the security community on 2026-11-02/03.
Why it matters
Langflow is an AI agent and workflow builder deployed broadly in enterprises, and its MCP endpoint can be reached without credentials under default configuration. The combination of unauthenticated auth-bypass and unauthenticated RCE, plus a public exploit and the framework's existing KEV history, means AI agents and the credentials/flows they touch (OpenAI/AWS credentials for connected AI workflows) are directly at risk from an off-the-shelf exploit.
Attack vector
Two unauthenticated critical flaws in the same Langflow release line: CVE-2026-93680 lets a remote attacker without credentials bypass authentication through the Model Context Protocol (MCP) endpoint when LANGFLOW_AUTO_LOGIN is enabled (public Metasploit module automates the bypass), and CVE-2026-110186 is an improper-control-of-code-generation path giving unauthenticated remote code execution reachable via MCP tool enumeration. An unauthenticated attacker can take over the AI agent server and run arbitrary OS commands.
Affected systems
Langflow / IBM Langflow OSS 1.0.0 through 1.12.8; fixed in 1.13.0 (also CVE-2026-110193 Agentic Assistant OS command execution and CVE-2026-110192 credential exposure in the same bulletin)
Mitigation
Upgrade to Langflow 1.13.0 (pip install --upgrade 'langflow==1.13.0' or langflowai/langflow:1.13.0). IBM provides no interim workaround; disable/password-protect auto-login, and restrict MCP endpoint exposure at the network layer. IBM security bulletin updated 2026-10-29.