Critical Langflow flaws enable authentication bypass and RCE

Summary

IBM patched four Langflow OSS flaws, two rated critical at CVSS 9.8, that enable authentication bypass, API credential leakage and code execution. CVE-2026-93680 is an incomplete fix of an earlier auto-login issue, CVE-2026-110186 allows unauthenticated code execution through MCP tool enumeration, and CVE-2026-110193 needs at least a low-privileged account. The flaws affect versions 1.0.0 to 1.12.8 and are fixed in 1.13.0.

Mitigation

Fixed in Langflow 1.13.0, available from PyPI and as a Docker image. Before upgrading, back up the database, secret key and uploaded files. If the deployment uses automatic login, prepare the existing account for password sign-in as described in the installation and Docker upgrade instructions. Upgrade Hono to version 4.13.5 to address three medium-severity flaws.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSimilar attack · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSimilar attack · NVD/CVE Database
• HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSimilar attack · AWS Security Bulletins