Two critical flaws in the popular open source AI agent building tool need no account to exploit.
The Hacker News reports that IBM's bulletin lists four Langflow CVEs, two of them rated critical at 9.8: CVE-2026-93680, an authentication bypass, and CVE-2026-110186, which allows arbitrary code execution, neither requiring an account. The bypass ties to Langflow's auto login feature, LANGFLOW_AUTO_LOGIN, which is enabled by default in version 1.12.8. A public Metasploit module already targets the authentication bypass, though it currently only lists the server's tools rather than executing code.
Neither flaw appeared in CISA's Known Exploited Vulnerabilities catalog as of its October 30 update. Langflow 1.13.0, released October 22, fixes both issues and turns automatic login off by default; version 1.12.8 remains exposed, and IBM offers no workaround for servers that cannot upgrade yet.
Why it matters: Langflow is widely used to build AI agents, and an unauthenticated path to code execution on an agent building platform puts both the pipelines it orchestrates and whatever credentials they hold at risk. Enterprises running Langflow should confirm they are on 1.13.0 or later and that auto login is disabled wherever upgrading is delayed.