PolicyCortex
Request Access
Summary
  • Two Langflow flaws score 9.8 and need no account.
  • Affected versions run from 1.0.0 through 1.12.8.
  • Version 1.13.0 fixes the flaws.
  • Back up data first, then upgrade and check exposure.

What happened

Langflow open source software (OSS) builds artificial intelligence (AI) agents and workflows. IBM published a security bulletin on October 28, 2026. It lists four flaws fixed in version 1.13.0. Versions 1.0.0 through 1.12.8 are affected. The fix shipped on October 22, 2026. The Hacker News covered the flaws on November 2, 2026.

The two flaws that need no account

The first flaw is CVE-2026-93680. It scores 9.8 on the Common Vulnerability Scoring System (CVSS) 3.1 scale. It is an improper authentication flaw. A remote attacker can bypass security restrictions. No account is needed.

The second flaw is CVE-2026-110186. It also scores 9.8 on the CVSS 3.1 scale. It is an improper control of code generation flaw. An unauthenticated attacker can run code on the server. The path runs through Model Context Protocol (MCP) tool enumeration.

The other two flaws

The third flaw is CVE-2026-110193. It scores 8.8 on the CVSS 3.1 scale. A low privileged authenticated account can abuse the Agentic Assistant. It can make the assistant submit component code. That code runs operating system commands on the server.

The fourth flaw is CVE-2026-110192. It scores 6.5 on the CVSS 3.1 scale. An authenticated attacker can read sensitive information. The source is insufficiently protected credentials.

What is not confirmed

Neither 9.8 flaw is in the Known Exploited Vulnerabilities catalog. The catalog check used here is the October 30, 2026 update. A public Metasploit module cites CVE-2026-93680 for unauthenticated MCP endpoint connection and tool listing only. It does not run code. Do not treat the module as proof of exploitation.

IBM also published 29 other Langflow flaw records on October 29, including CVE-2026-104339, rated 9.8.

What to do

Back up the database, the secret key, and uploaded files first. Install Langflow 1.13.0 with pip using pip install "langflow==1.13.0". Docker users can pull langflowai/langflow:1.13.0. Version 1.13.0 turns automatic login off by default. Prepare existing accounts for password sign in if automatic login was used. Check whether the server was exposed to untrusted networks. Record the old version, the new version, and the patch date.

The governance lesson

An AI tool on a server is part of the system boundary. Its version, its exposure, and its patch state are evidence. An unauthenticated flaw in that tool breaks the boundary claim. A patch note alone is not proof. Proof is the version check after the patch and the exposure record. PolicyCortex helps teams link that proof to requirements.

Sources

Next step

Upgrade every Langflow server to 1.13.0, then record proof of the patch.

Questions on this record
Which Langflow versions are affected?
Versions 1.0.0 through 1.12.8. Version 1.13.0 fixes the flaws.
Does an attacker need an account?
No. The two 9.8 flaws need no account at all.
Is exploitation confirmed in the wild?
No. Neither 9.8 flaw is in the Known Exploited Vulnerabilities catalog.
What should teams do first?
Back up data, upgrade to 1.13.0, and record proof of the patch.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. LXD Certificate Check Flaw Grants Full Cluster AccessCanonical warns that a certificate validation flaw in LXD and MicroCloud lets an attacker pose as any trusted client. Patch to the fixed release and limit API access.5 min
  2. Drupal Commerce Access Bypass Is Actively ExploitedDrupal warns that attackers are already using an access bypass flaw in Commerce Core. Patch to the fixed release and audit orders for tampering.5 min
  3. Ivanti Gateway Chain Grows With Two New Exploited FlawsCISA added two more Ivanti Connect Secure flaws to its exploited list on October 30, 2026. Together with an earlier flaw, they form a chain attackers already used.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere