Critical Langflow Flaws: Update to 1.13.0 Now

On October 28, 2026, IBM disclosed several flaws in Langflow, the open-source tool for building chatbots, agents and AI workflows. Two are critical (9.8 out of 10) and need no account. They affect versions 1.0.0 through 1.12.8 and are fixed in 1.13.0. Anyone running Langflow on their own server should act.

What we know

  • The advisory: IBM, which maintains Langflow, published its security bulletin on October 28 and updated it on the 29th. IBM assigned the CVE records on October 29.
  • The two critical flaws: per the bulletin, CVE-2026-93680 lets a remote attacker bypass security restrictions because of improper authentication, and CVE-2026-110186 lets them run code on the server. Both score 9.8 on CVSS and, according to the CVE record, need neither an account nor user interaction.
  • The other two Langflow flaws: CVE-2026-110193 (8.8) lets a user with a low-privileged account get the agentic assistant to generate code that runs system commands; CVE-2026-110192 (6.5) exposes sensitive information through poorly protected credentials. The bulletin also lists three flaws in Hono, a library Langflow uses, fixed in Hono 4.13.5.
  • The fix: IBM asks users to upgrade to Langflow 1.13.0 and to back up the database, the secret key and uploaded files first. Its mitigations section says «None»: no setting replaces the upgrade.
  • Auto-login: the release notes for 1.13.0, published October 22, include «disable automatic login by default». According to The Hacker News, version 1.12.8 shipped with it on and logged users in as superuser.
  • Attacks: according to The Hacker News, as of October 30 neither critical flaw was in CISA's catalog of exploited vulnerabilities, though six other Langflow flaws are, the latest added in August. The same outlet reports a public Metasploit module for CVE-2026-93680 that, for now, only lists tools and does not run code.

What changes and what doesn't

  • It changes things for anyone running Langflow on their own server or VPS, especially if its interface or API is reachable from the internet: a customer support chatbot, an internal agent, or a flow that answers questions from company documents.
  • It matters less if Langflow only runs on your laptop for testing and doesn't listen on the network. Upgrading is still wise.
  • Nothing changes if you use a cloud chatbot service that isn't built on Langflow, or for the website itself: WordPress, Drupal and your hosting are not involved.
  • What's at stake: Langflow usually stores the keys for the AI providers and databases its flows use. A compromised server can expose those keys.

How to tell if it affects you

  1. Find out whether your chatbot or agent uses Langflow. If someone else built it, ask: «Is it built on Langflow? Which version, and where is it installed?».
  2. Check the version. If it was installed with pip or uv, `pip show langflow` (or `uv pip show langflow`) shows it. If it runs in Docker, check the image tag. Anything from 1.0.0 to 1.12.8 is affected.
  3. Check whether it is reachable from the internet. If the Langflow address opens from outside your office or home network, this is urgent. While you upgrade, block it at the firewall or allow only trusted addresses.
  4. Upgrade to 1.13.0 after backing up the database, the secret key and uploaded files, as IBM advises. Read the release notes first: auto-login and the way local knowledge bases are stored both change.
  5. After upgrading, review access. Make sure auto-login is off and that every user signs in with their own password.
  6. If it was internet-facing on an affected version, rotate your keys. Issue new API keys for your AI providers and new passwords for the databases Langflow stored, and check those providers' dashboards for unusual usage.

Related: LiteLLM 1.107.0 Shipped Malware: What to Do With AI Keys

Sources

Updates: if real-world exploitation of these flaws is confirmed or IBM changes the fixed version, it will be added here with a link.