Critical Langflow Flaws Allow Unauthenticated RCE via MCP; Fix in 1.13.0
jedisct1 · x · 2026-11-02
IBM disclosed four vulnerabilities in the open-source AI agent workflow tool Langflow, affecting every release from 1.0.0 through 1.12.8; version 1.13.0 is the only fix.
- Two rated CVSS 9.8: CVE-2026-93680 (authentication bypass, no account needed) and CVE-2026-110186 (arbitrary code execution, no account needed)
- The RCE is exploitable unauthenticated through MCP tool enumeration — Langflow exposes its flows as tools to MCP-capable AI apps
- CVE-2026-110193 (8.8): a low-privileged account can make the Agentic Assistant generate component code running OS commands
- CVE-2026-110192 (6.5): insufficiently protected credentials may leak sensitive data
- A public Metasploit module already targets CVE-2026-93680; CISA's KEV catalog lists six other Langflow flaws
More from coding & agent
- Grok Bot template roundup: Home Assistant watchdog, Quarto blog shipper, X unfollow tool — RachelVT42 · 2026-11-02
- Harnis: an open-source call-level seatbelt for local stdio MCP servers — L00pLegend · 2026-11-02
- RAGFlow: BM25+grep alone hits 91% FRAMES on MiniMax M3, no vector index — dair_ai · 2026-11-02
- A 144M model drives most NPC choices in a village sim that learns on a 6GB laptop GPU — Whoa_damn_ · 2026-11-02
- AI favors engineers who care about outcomes over the craft itself — brada · 2026-11-02
- Claude builds an explainer-video workflow from scratch in Managed Agents — brada · 2026-11-02