IBM Security disclosed two critical vulnerabilities in Langflow on November 3, 2026: CVE-2026-93680 (CVSS 9.8) and CVE-2026-110186 (CVSS 9.8). Both affect versions 1.0.0 through 1.12.8 and allow unauthenticated remote code execution. Version 1.13.0, released October 22, 2026, is the only fix. If you are running Langflow in any environment accessible from an untrusted network, upgrade immediately.
What the flaws do
CVE-2026-93680 bypasses authentication entirely due to improper access controls. Any unauthenticated attacker with network access to the Langflow instance can reach protected API endpoints and execute code. A public Metasploit module exists for this CVE.
CVE-2026-110186 exploits the Model Context Protocol (MCP) integration. Langflow exposes AI workflow flows as MCP tools, allowing AI models to invoke them through the MCP interface. The vulnerability is in that MCP tool enumeration path: an unauthenticated attacker can send crafted requests through the MCP endpoint to trigger code execution without credentials. The flaw is architecturally interesting because the attack surface exists specifically at the boundary where Langflow bridges AI orchestration and the broader MCP ecosystem.
Compounding risk: auto-login enabled by default
Version 1.12.8 ships with LANGFLOW_AUTO_LOGIN enabled by default. This configuration bypasses the authentication layer for local or single-user deployments. In network-exposed deployments, it eliminates even the nominal credential check. Combined with CVE-2026-93680, the effective attack surface for unauthorized access is as wide as network access to the port.
Langflow's history on CISA KEV
Six earlier Langflow vulnerabilities are already on the CISA Known Exploited Vulnerabilities catalog. This is not an isolated patching event: Langflow has a documented pattern of critical vulnerabilities being actively exploited. Organizations building AI pipelines on Langflow should evaluate whether their deployment cadence can keep pace with the vulnerability rate.
Actions
- Upgrade to Langflow 1.13.0 immediately. There is no workaround for CVE-2026-93680 or CVE-2026-110186 in earlier versions.
- Disable LANGFLOW_AUTO_LOGIN explicitly in production deployments even after upgrading. Confirm the setting in your environment configuration.
- Restrict network access. Langflow should not be directly accessible from untrusted networks. Place it behind authentication proxies or VPN; do not expose the MCP endpoint to the public internet.
- Search for exploitation indicators. The public Metasploit module for CVE-2026-93680 produces recognizable request patterns. Review your Langflow access logs for unusual requests to authentication bypass endpoints and MCP tool enumeration paths.
- Assess your MCP attack surface broadly. Any service that exposes MCP tool endpoints should be reviewed for authentication controls. The Langflow flaws illustrate that MCP endpoints can be as exploitable as any other API if authentication is not enforced.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are building AI pipelines and want a security review of your MCP architecture.