Overview
IBM disclosed four vulnerabilities in Langflow, an open-source platform for building AI agents and LLM-powered workflows, with two rated critical at CVSS 9.8. CVE-2026-93680 allows unauthenticated authentication bypass, and CVE-2026-110186 permits unauthenticated remote code execution via improper control of code generation. Every Langflow release from 1.0.0 through 1.12.8 is affected. The sole fix is version 1.13.0, released October 22, 2026. No CISA KEV listing exists for these two flaws as of October 30, though six earlier Langflow vulnerabilities are already catalogued there.
Technical Analysis
The most severe attack surface involves Langflow’s Model Context Protocol (MCP) integration. MCP allows Langflow to expose its flows as callable tools to external AI applications. CVE-2026-93680 exploits a default configuration flaw: the LANGFLOW_AUTO_LOGIN setting is enabled by default in Langflow 1.12.8, which logs users in as superusers without credential prompts. IBM describes this as an “unauthenticated remote code execution exploitable through model context protocol tool enumeration.”
A public Metasploit Framework module already operationalises CVE-2026-93680. It connects to a Langflow server’s MCP endpoint without credentials, establishes a session, and enumerates available tools — providing attackers with a low-friction reconnaissance and initial access capability. The module’s author notes a slightly narrower affected range (1.5.0–1.11.4) than IBM’s bulletin.
CVE-2026-110186 (CVSS 9.8) enables arbitrary code execution through improper control of code generation, requiring no account. CVE-2026-110193 (CVSS 8.8) allows a low-privileged user to manipulate the Agentic Assistant to generate or submit component code that executes OS commands server-side. CVE-2026-110192 (CVSS 6.5) exposes sensitive credentials to authenticated users.
IBM’s bulletin also identifies an “incomplete remediation of an auto-login security control,” suggesting prior partial fixes were insufficient and that default-on auto-login has been a recurring attack vector.
Framework Mapping
- AML.T0040 – AI Model Inference API Access: Attackers connect to Langflow’s MCP inference endpoint without authentication to probe server capabilities.
- AML.T0084 – Discover AI Agent Configuration: Tool enumeration via MCP reveals deployed flows, agents, and their configurations.
- AML.T0081 – Modify AI Agent Configuration: CVE-2026-110193 allows manipulation of the Agentic Assistant to inject OS-level commands.
- AML.T0086 – Exfiltration via AI Agent Tool Invocation: Compromised agent tools could be leveraged for data exfiltration post-exploitation.
- LLM07 – Insecure Plugin Design: The MCP tool layer lacks adequate authentication enforcement, mirroring classic insecure plugin design patterns.
- LLM08 – Excessive Agency: The Agentic Assistant’s ability to execute OS commands on the server represents excessive, insufficiently guarded agency.
Impact Assessment
Any internet-exposed Langflow instance running versions 1.0.0–1.12.8 with default settings is effectively an open RCE target. The presence of a Metasploit module significantly lowers exploitation complexity. Enterprises using Langflow to orchestrate production AI pipelines, RAG systems, or customer-facing agents face full server compromise, credential theft, and potential lateral movement into connected infrastructure.
Mitigation & Recommendations
- Upgrade immediately to Langflow 1.13.0 (
pip install --upgrade "langflow==1.13.0"or thelangflowai/langflow:1.13.0Docker image). - Back up the database, secret key, and uploaded files before upgrading.
- Disable
LANGFLOW_AUTO_LOGINon any instance that cannot immediately patch — this removes the primary unauthenticated attack path. - Audit MCP endpoints for unexpected session activity or tool enumeration.
- Network-segment Langflow deployments and restrict public internet exposure until patched.
- Monitor for Metasploit-pattern MCP connection attempts in server logs.