CVE-2026-93680
CVSS 9.8 CRITICAL: iBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…
Vulnerabilities & Exploits
IBM disclosed two critical Langflow flaws on October 28: unauthenticated remote code execution and a separate authentication bypass. They affect releases 1.0.0 through 1.12.8; Langflow 1.13.0 fixes them.
Langflow can offer workflows as tools to AI applications through the Model Context Protocol (MCP). IBM says the code-execution path abuses the MCP tool-enumeration route, letting an attacker reach server-side code without an account. A public Metasploit module can connect without credentials and list tools, but does not execute code. IBM’s disclosure does not report exploitation; neither flaw was in CISA’s Known Exploited Vulnerabilities catalog as of October 30.
For teams connecting AI applications to Langflow workflows, server-side execution could affect systems or data those workflows can access. The reporting does not establish whether any connected integrations or credentials were exposed in a particular deployment.
1 source · 5h ago
CVSS 9.8 CRITICAL: iBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…
The Hacker News
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
Langflow 1.13.0 fixes two critical flaws that could let unauthenticated attackers bypass authentication or remotely execute code.
originalPart of the PlainSec briefing for 2026-11-02
Every edition of this story: Langflow MCP flaw exposes servers to code execution