WORLDTECHIBM Flags Seven Langflow Flaws, Two Scored 9.8, Fixed in Version 1.13.0
IBM has disclosed seven vulnerabilities in Langflow OSS, among them critical flaws that can be exploited remotely without credentials. According to a report by GBHackers, the company's security bulletin covers Langflow versions 1.0.0 through 1.12.8 and recommends that administrators move to version 1.13.0.
Scope of the disclosed flaws
IBM's bulletin, published October 28 and updated October 29, says the weaknesses could allow arbitrary code execution, exposure of API credentials, circumvention of authentication and attacks that travel through bundled dependencies. IBM, a software and information technology consulting firm headquartered in Armonk, counts authentication bypass and code injection among the critical problems that outside attackers can trigger without any login.
Two of the flaws carry CVSS scores of 9.8, a rating that points to network-reachable exploitation with low complexity and no need for privileges or user action. One of them, CVE-2026-93680, involves improper authentication that lets remote attackers get past security restrictions. A separate flaw, CVE-2026-110186, enables arbitrary code execution because control over generated code is insufficient.
Affected versions and fixes
The bulletin covers Langflow releases 1.0.0 through 1.12.8 and advises administrators to update to 1.13.0. IBM's summary also points to an automatic-login security control that was not fully remediated.
IBM additionally lists three issues in the Hono framework dependency, all fixed in Hono 4.13.5.
Limits of the bulletin
The bulletin describes unauthenticated remote code execution reachable through Model Context Protocol tool enumeration. Its individual CVE descriptions, however, do not tie every summarised attack mechanism to a specific identifier. CVE-2026-110192, according to the report, lets authenticated attackers obtain sensitive information through poorly protected credentials, so not every issue is exploitable without logging in. The bulletin does not establish that attackers must chain these flaws together.
The report describes the exposure as especially serious because cryptomining attacks against Langflow servers have already exploited an older, separate vulnerability. The risks widen the attack surface of vulnerable MCP servers, where external integrations can expose sensitive functions.
Open questions
- Which of the summarised attack mechanisms map to specific CVE identifiers?
- Does exploitation require chaining the disclosed vulnerabilities?