CVE-2026-93680CVSS 9.8Authentication bypass
Remote access without credentials can bypass authentication restrictions; IBM describes incomplete auto-login remediation.
Langflow bulletin discloses unauthenticated RCE and auth bypass; upgrade to 1.13.0
IBM discloses critical unauthenticated code execution and authentication bypass affecting Langflow OSS 1.0.0–1.12.8, alongside authenticated issues and Hono dependency flaws. Upgrade to 1.13.0 after backing up data and preparing password sign-in.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- CVSS 9.8 × 2
- 7 CVEs tracked here
- Splash zone
- Langflow OSS 1.0.0–1.12.8; critical remote paths need no login, while other issues have narrower prerequisites
- python · langflow
- In the wild
- Unknown
- The cited vendor bulletin does not confirm real-world exploitation.
What happened
IBM’s October 28 bulletin is the disclosure tracked here, with the October 29 clarification incorporated. The 1.13.0 release already existed on October 22. The bulletin combines four Langflow product CVEs with three older Hono dependency CVEs; it does not establish that every deployment exposes every dependency path. Hono’s underlying fixes are in 4.13.5, while IBM’s product remediation is Langflow 1.13.0. Upgrade the application rather than substituting an unverified dependency-only change.
The critical product vectors require no credentials; Agentic Assistant code execution and the credential-disclosure CVE require authenticated access. The bulletin’s summary also mentions API-key access without intended authorization, while the credential CVE’s vector requires low privileges; do not generalize that path to all anonymous users. No exact exploit endpoint, confirmed victim count or real-world exploitation is established by the cited bulletin. L3 reflects a mainstream AI workflow server and serious disclosed attack paths.
What’s in the bowl
CVE-2026-110186CVSS 9.8Unauthenticated code execution
Remote code execution without credentials; the bulletin describes an MCP tool-enumeration attack surface.
CVE-2026-110193CVSS 8.8Agentic Assistant code execution
A low-privileged authenticated user can submit or generate component code through unblocked patterns and execute OS commands.
CVE-2026-110192CVSS 6.5Insufficiently protected credentials
Authenticated remote access may disclose sensitive information; the bulletin also discusses operator-injected API key exposure.
CVE-2026-84363CVSS 5.9Hono query and cache interpretation mismatch
A literal URL fragment passed by the runtime/intermediary can hide query parameters from filters and cache keys. Fragment-stripping paths, including Cloudflare Workers, are outside this Hono exposure.
CVE-2026-84364CVSS 5.3Hono dot-notation memory exhaustion
Only endpoints enabling non-default dot-notation body parsing are affected; nested form fields can exhaust memory.
CVE-2026-84365CVSS 6.5Hono static-generation traversal
Build-time SSG can write outside its output directory when ssgParams are untrusted; ordinary request routing and fully developer-controlled parameters are outside scope.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Langflow OSS | 1.13.0 | IBM recommended product fix |
Crime-scene timeline
Oct 22, 2026
Langflow 1.13.0 release is available
Oct 28, 2026
IBM initially publishes the multi-vulnerability bulletin
Oct 29, 2026
IBM clarifies remediation and publishes product CVE records
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- IBM Langflow security bulletinPrimaryInitially published October 28, updated October 29; seven listed CVEs and product upgrade to 1.13.0.
- Langflow installation and upgrade preparationPrimaryAuto-login transition and existing-account preparation; avoid data-destructive access recovery.
- Langflow Docker upgrade guidePrimaryConfiguration and data-location checks required before replacing containers.
- Langflow 1.13.0 releasePrimaryRelease availability predates the IBM disclosure; patch date is not the incident disclosure date.