Vulnerabilities · 4h ago

Langflow MCP flaw exposes servers to code execution

IBM disclosed two critical Langflow flaws on October 28: unauthenticated remote code execution and a separate authentication bypass. They affect releases 1.0.0 through 1.12.8; Langflow 1.13.0 fixes them.

Langflow can offer workflows as tools to AI applications through the Model Context Protocol (MCP). IBM says the code-execution path abuses the MCP tool-enumeration route, letting an attacker reach server-side code without an account. A public Metasploit module can connect without credentials and list tools, but does not execute code. IBM’s disclosure does not report exploitation; neither flaw was in CISA’s Known Exploited Vulnerabilities catalog as of October 30.

For teams connecting AI applications to Langflow workflows, server-side execution could affect systems or data those workflows can access. The reporting does not establish whether any connected integrations or credentials were exposed in a particular deployment.

CVE-2026-93680

NVD KEV

CVSS 9.8 CRITICAL: iBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…

Timeline

Nov 2 Reported by The Hacker News

Sources

1 source covering this story

The Hacker News Nov 2
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers
Langflow 1.13.0 fixes two critical flaws that could let unauthenticated attackers bypass authentication or remotely execute code.

Entities

CVE-2026-93680

Part of the PlainSec briefing for 2026-11-02

Editions

Briefing for 2026-11-02

Vulnerabilities · 4h agoLangflow MCP flaw exposes servers to code executionIBM disclosed two critical Langflow flaws on October 28: unauthenticated remote code execution and a separate authentication bypass. They affect releases 1.0.0 through 1.12.8; Langflow 1.13.0 fixes them.Langflow can offer workflows as tools to AI applications through the Model Context Protocol (MCP). IBM says the code-execution path abuses the MCP tool-enumeration route, letting an attacker reach server-side code without an account. A public Metasploit module can connect without credentials and list tools, but does not execute code. IBM’s disclosure does not report exploitation; neither flaw was in CISA’s Known Exploited Vulnerabilities catalog as of October 30.For teams connecting AI applications to Langflow workflows, server-side execution could affect systems or data those workflows can access. The reporting does not establish whether any connected integrations or credentials were exposed in a particular deployment.