--- title: "Langflow Flaws Let Attackers In Without an Account" description: "Two flaws in Langflow score 9.8. An attacker needs no account to bypass checks or run code through agent tools." url: https://policycortex.com/blog/langflow-unauthenticated-rce-ai-agent-flaws sealed: 2026-11-02 register: blog/langflow-unauthenticated-rce-ai-agent-flaws records: 3 digest: sha3:631a4667c8c88110ca1f2f18c50271884630d4a8c2bc0d8fe7d9025c92ccfe23 --- # Langflow Flaws Let Attackers In Without an Account Resources / Blog Two flaws in Langflow score 9.8. An attacker needs no account to bypass checks or run code through agent tools. Leonard Esere · Sealed 2026-11-02 · Reading time 3 min Filed under: [Langflow](https://policycortex.com/blog/tags/langflow), [AI agents](https://policycortex.com/blog/tags/ai-agents), [authentication](https://policycortex.com/blog/tags/authentication), [remote code execution](https://policycortex.com/blog/tags/remote-code-execution), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation) **Summary** - Two Langflow flaws score 9.8 and need no account. - Affected versions run from 1.0.0 through 1.12.8. - Version 1.13.0 fixes the flaws. - Back up data first, then upgrade and check exposure. ## What happened Langflow open source software (OSS) builds artificial intelligence (AI) agents and workflows. IBM published a security bulletin on October 28, 2026. It lists four flaws fixed in version 1.13.0. Versions 1.0.0 through 1.12.8 are affected. The fix shipped on October 22, 2026. The Hacker News covered the flaws on November 2, 2026. ## The two flaws that need no account The first flaw is [CVE-2026-93680](https://www.cve.org/CVERecord?id=CVE-2026-93680). It scores 9.8 on the Common Vulnerability Scoring System (CVSS) 3.1 scale. It is an improper authentication flaw. A remote attacker can bypass security restrictions. No account is needed. The second flaw is [CVE-2026-110186](https://www.cve.org/CVERecord?id=CVE-2026-110186). It also scores 9.8 on the CVSS 3.1 scale. It is an improper control of code generation flaw. An unauthenticated attacker can run code on the server. The path runs through Model Context Protocol (MCP) tool enumeration. ## The other two flaws The third flaw is [CVE-2026-110193](https://www.cve.org/CVERecord?id=CVE-2026-110193). It scores 8.8 on the CVSS 3.1 scale. A low privileged authenticated account can abuse the Agentic Assistant. It can make the assistant submit component code. That code runs operating system commands on the server. The fourth flaw is [CVE-2026-110192](https://www.cve.org/CVERecord?id=CVE-2026-110192). It scores 6.5 on the CVSS 3.1 scale. An authenticated attacker can read sensitive information. The source is insufficiently protected credentials. ## What is not confirmed Neither 9.8 flaw is in the Known Exploited Vulnerabilities catalog. The catalog check used here is the October 30, 2026 update. A public Metasploit module cites [CVE-2026-93680](https://www.cve.org/CVERecord?id=CVE-2026-93680) for unauthenticated MCP endpoint connection and tool listing only. It does not run code. Do not treat the module as proof of exploitation. IBM also published 29 other Langflow flaw records on October 29, including [CVE-2026-104339](https://www.cve.org/CVERecord?id=CVE-2026-104339), rated 9.8. ## What to do Back up the database, the secret key, and uploaded files first. Install Langflow 1.13.0 with pip using `pip install "langflow==1.13.0"`. Docker users can pull `langflowai/langflow:1.13.0`. Version 1.13.0 turns automatic login off by default. Prepare existing accounts for password sign in if automatic login was used. Check whether the server was exposed to untrusted networks. Record the old version, the new version, and the patch date. ## The governance lesson An AI tool on a server is part of the system boundary. Its version, its exposure, and its patch state are evidence. An unauthenticated flaw in that tool breaks the boundary claim. A patch note alone is not proof. Proof is the version check after the patch and the exposure record. PolicyCortex helps teams link that proof to requirements. ## Sources - IBM security bulletin, Langflow OSS is affected by multiple vulnerabilities, published October 28, 2026, updated October 29, 2026. https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2 - The Hacker News article, November 2, 2026. https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html?m=1 - [CVE-2026-93680](https://www.cve.org/CVERecord?id=CVE-2026-93680) record, CVE Program - [CVE-2026-110186](https://www.cve.org/CVERecord?id=CVE-2026-110186) record, CVE Program - [CVE-2026-110193](https://www.cve.org/CVERecord?id=CVE-2026-110193) record, CVE Program - [CVE-2026-110192](https://www.cve.org/CVERecord?id=CVE-2026-110192) record, CVE Program - [CVE-2026-104339](https://www.cve.org/CVERecord?id=CVE-2026-104339) record, CVE Program - Original diagram by PolicyCortex. ## Next step Upgrade every Langflow server to 1.13.0, then record proof of the patch. **Questions on this record** **Q: Which Langflow versions are affected?** A: Versions 1.0.0 through 1.12.8. Version 1.13.0 fixes the flaws. **Q: Does an attacker need an account?** A: No. The two 9.8 flaws need no account at all. **Q: Is exploitation confirmed in the wild?** A: No. Neither 9.8 flaw is in the Known Exploited Vulnerabilities catalog. **Q: What should teams do first?** A: Back up data, upgrade to 1.13.0, and record proof of the patch. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-11-02 | [LXD Certificate Check Flaw Grants Full Cluster Access](https://policycortex.com/blog/lxd-microcloud-certificate-validation-flaw): Canonical warns that a certificate validation flaw in LXD and MicroCloud lets an attacker pose as any trusted client. Patch to the fixed release and limit API access. | 5 min | | 2026-11-01 | [Drupal Commerce Access Bypass Is Actively Exploited](https://policycortex.com/blog/drupal-commerce-access-bypass-actively-exploited): Drupal warns that attackers are already using an access bypass flaw in Commerce Core. Patch to the fixed release and audit orders for tampering. | 5 min | | 2026-10-31 | [Ivanti Gateway Chain Grows With Two New Exploited Flaws](https://policycortex.com/blog/ivanti-kev-chain-second-stage-october-2026): CISA added two more Ivanti Connect Secure flaws to its exploited list on October 30, 2026. Together with an earlier flaw, they form a chain attackers already used. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-11-02 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/langflow-unauthenticated-rce-ai-agent-flaws ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 2b299e5999c1 | fe4ca9003424 | | REC 0001 | BODY | 484191678f6c | 2b299e5999c1 | | REC 0002 | RELATED RECORDS | 631a4667c8c8 | 484191678f6c | Head sha3:631a4667c8c88110ca1f2f18c50271884630d4a8c2bc0d8fe7d9025c92ccfe23. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.