Langflow Unauthenticated Authentication Bypass and Remote Code Execution (CVE-2026-93680 / CVE-2026-110186)

Scope: Langflow, versions 1.0.0 through 1.12.8, fixed in 1.13.0

Severity: Red

Langflow, an open-source tool for building AI agents and workflows whose vulnerability reports are handled by IBM, has two critical flaws affecting every release from 1.0.0 through 1.12.8. CVE-2026-93680 is an authentication bypass caused by improper authentication handling that lets a remote attacker with no account at all bypass security restrictions entirely. CVE-2026-110186 allows that same unauthenticated attacker to run arbitrary code because of improper control of code generation. A module already exists in the public Metasploit Framework specifically targeting the authentication bypass, meaning exploitation requires no custom tooling from an attacker, just a standard, widely available penetration testing module. This is not Langflow’s first brush with serious flaws; CISA’s exploited vulnerabilities catalog already lists six other Langflow CVEs, the most recent added in August. Given how quickly AI workflow and agent infrastructure is being stood up across organisations, often without the same security review applied to traditional production systems, this combination of a Metasploit module and no-authentication-required exploitation makes Langflow instances a realistic, low-effort target. Organisations running Langflow must update to version 1.13.0 immediately, since it is the only release that addresses both flaws, and any Langflow instance reachable from the internet should be treated as a priority.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.