IBM discloses critical Langflow remote-code-execution and authentication-bypass flaws

IBM disclosed two critical Langflow vulnerabilities in a security bulletin published Oct. 28, 2026, and updated Oct. 29, 2026. The flaws let attackers run code remotely or bypass authentication with no account required. The flaws affect all versions from 1.0.0 through 1.12.8, and version 1.13.0 is the only fix.

IBM said one flaw allows unauthenticated remote code execution through Model Context Protocol tool enumeration. The Model Context Protocol lets Langflow share its flows as tools with AI applications that support MCP. The public Metasploit Framework module for CVE-2026-93680 gains access by reaching an uncredentialed Langflow server endpoint, then starts a session and lists available tools.

The module’s author lists versions 1.5.0 through 1.11.4 as affected, which is narrower than IBM’s range. Tests used Langflow 1.8.4 with automatic login turned on. Langflow version 1.12.8 turns on the LANGFLOW_AUTO_LOGIN setting by default, so the platform logs users in as superusers without asking for credentials.

IBM said another of the four flaws involves an incomplete fix for an auto-login security control. The bulletin does not say whether that flaw affects servers with automatic login turned off. Langflow’s own code description states that LANGFLOW_AUTO_LOGIN skips authentication and Langflow intends it for development environments only.

Version 1.13.0 of Langflow shipped on Oct. 22, 2026, and disables automatic login by default. Version 1.12.8, which shipped the same day, is still vulnerable. PyPI shows no later 1.12 releases as of Nov. 2, 2026. IBM published 33 CVE records on Oct. 29, 2026, and none of them lists Langflow 1.13.0 as affected.

On Oct. 29, 2026, IBM released CVE records covering 29 more Langflow vulnerabilities, with versions 1.12.4 and 1.12.5 set as the fixes. IBM rated CVE-2026-104339 at 9.8. That flaw, part of the additional records, permits unauthenticated arbitrary code execution. The CISA Known Exploited Vulnerabilities catalog did not include the two new flaws as of its Oct. 30 update.

CISA’s Known Exploited Vulnerabilities catalog lists six other Langflow flaws, with CVE-2026-9198 the most recent addition in August. CISA issued a warning that CVE-2026-9198 was under exploitation following the public release of multiple proof-of-concept exploits.

Langflow is open-source software for building AI agents and workflows. IBM takes in the vulnerability reports and coordinates disclosure of flaws in the project. Langflow instances store API keys for OpenAI and Anthropic along with cloud credentials and database connection strings.

Prior Langflow flaws exploited in 2026 include CVE-2026-0768, an unauthenticated remote code execution flaw in Langflow’s component editor code validator disclosed in January, affecting versions 1.4.2 and earlier. The problem comes from poor validation of a user-supplied string before Python code runs in the validate endpoint. VulnCheck spotted CVE-2026-0768 attempts against UK honeypots, counting at least 50 over one weekend with most traffic coming from Russia. Lead security researcher Caitlin Condon said no public proof-of-concept exploit is known to exist.

In March 2026, attackers hit CVE-2026-33017 roughly one day after disclosure. They executed Python scripts and gathered .ENV and database files. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint contains CVE-2026-33017 and lets users build public flows without authentication. Malicious code for this flaw goes directly to Python’s exec() function with no sandboxing, resulting in complete system compromise.

CVE-2026-33017 hits Langflow versions before 1.9.0. NVD published it on March 20, 2026, and updated the entry on March 26, 2026. Sysdig saw exploitation attempts under 24 hours after disclosure even though no public proof-of-concept existed. Michael Clark, a Sysdig researcher, counted more than 1,000 exploitation attempts across regions in one week.

Attackers leveraged CVE-2026-5027 to write arbitrary files onto vulnerable servers. Using CVE-2026-55255, they reached AI workflows owned by other users, took sensitive data and added second-stage implants. With CVE-2026-0770, attackers executed root-level commands and tried to deploy malware while pulling cloud credentials, environment variables, and container metadata.

CVE-2025-3248 earned a 9.8 score on CVSS v3.1 and helped deploy the Flodrix botnet. CVE-2026-5027 scored 8.8 and enabled arbitrary file write leading to unauthenticated remote code execution via path traversal. Without credentials, attackers can exploit CVE-2026-5027 when auto-login is on by grabbing a token from the /api/v1/auto_login endpoint.

A public proof of concept drops a cron job into /etc/crontab, and system cron runs it as root. Attackers pulled keys and credentials and could move sideways into connected databases and services, potentially exposing victims to supply chain attacks through CI/CD or software package credentials. Langflow’s advisory provided threat actors with enough information to build a working exploit without more research.

Sysdig warned that organizations following scheduled patch cycles will lose the race to attackers exploiting Langflow flaws. Sysdig described JadePuffer as the first ransomware campaign handled by an autonomous AI agent from beginning to end. JadePuffer used CVE-2025-3248, a critical Langflow vulnerability scored at 9.8, even though the fix shipped before the attack.

The agent pulled Langflow’s PostgreSQL database and took keys for OpenAI, Anthropic, DeepSeek, and Google along with cloud logins for AWS, Azure, Alibaba, and Tencent. The agent encrypted all 1,342 Nacos configuration items. The ransom note asked for Bitcoin with a Proton Mail address.

Sysdig counted more than 600 distinct payloads. The agent corrected its own mistakes in as little as 31 seconds. Ensar Seker of SOCRadar Cyber Intelligence Inc. said the agent handled every step itself—scouting the target, breaking in, finding credentials, pushing deeper into the network, and demanding payment—adjusting on the fly when something failed.

Erich Kron from KnowBe4 said AI agents are not the same as LLMs because they are goal-oriented entities that pick their own method to reach a goal using the provided tools. Sysdig recommends patching Langflow, keeping code-running endpoints away from the open internet, and storing secrets in a dedicated manager.

Before upgrading to Langflow 1.13.0, administrators should back up the database, secret key, and uploaded files. Servers that use automatic login should get the existing account ready for password sign-in per Langflow’s upgrade guidance before moving to 1.13.0. Administrators can run pip install –upgrade “langflow==1.13.0” to move the Python package to Langflow 1.13.0.

Docker deployments should switch to the langflowai/langflow:1.13.0 image while retaining the deployment’s persistent data. After upgrading, if sign-in fails, administrators should use Langflow’s recovery steps and not delete or reinstall the platform.