IBM's bulletin for the open-source Langflow AI agent-builder flags two critical flaws: CVE-2026-93680 (CVSS 9.8, authentication bypass reachable with no account) and CVE-2026-110186 (CVSS 9.8), described as unauthenticated remote code execution exploitable through Model Context Protocol tool enumeration — Langflow can expose its flows as MCP tools to AI applications. A further high-severity issue (CVE-2026-110193, 8.8) lets a low-privileged account make the Agentic Assistant generate or submit component code that runs operating-system commands, and CVE-2026-110192 (6.5) exposes insufficiently protected credentials. Every release from 1.0.0 through 1.12.8 is affected; the only fix is 1.13.0. A public Metasploit module already cites the authentication bypass, and the default-on LANGFLOW_AUTO_LOGIN setting in 1.12.8 — which "bypasses authentication and should only be used in development environments" — makes misconfigured deployments trivially reachable. The flaws are not yet in CISA's KEV catalog, but the Metasploit coverage means organisations running Langflow should treat this as urgent rather than advisory.

• Source article