CVE-2026-93680: Langflow RCE via Auth Bypass Hits All 1.x
Two critical vulnerabilities in Langflow, the widely-used open-source AI agent and workflow builder, allow unauthenticated remote attackers to bypass authentication and execute arbitrary code on affected servers running versions 1.0.0 through 1.12.8. A Metasploit module already targets the authentication bypass flaw (CVE-2026-93680) via Langflow's Model Context Protocol endpoint, lowering the bar for exploitation. The only remediation is upgrading to version 1.13.0, with no available workaround for systems that cannot immediately patch.