Langflow OSS: unauthenticated RCE and auth bypass (CVE-2026-110186, CVE-2026-93680), fixed in 1.13.0

IBM published a security bulletin on Oct 28 2026 for Langflow OSS 1.0.0 through 1.12.8, the open source AI workflow builder. It covers an unauthenticated remote code execution flaw (CVE-2026-110186, CVSS 9.8) that IBM says is exploitable through model context protocol tool enumeration, an incomplete fix of the auto-login security control that allows an authentication bypass (CVE-2026-93680, CVSS 9.8), several authenticated code execution bugs (CVSS 8.8), API key exposure, path traversal, and vulnerable bundled dependencies such as Hono. The fix is to upgrade to Langflow OSS 1.13.0 or later; IBM lists no workarounds. Companion IBM bulletins for Langflow OSS add CVE-2026-104339 (CVSS 9.8, unauthenticated OS command injection leading to code execution) and CVE-2026-107328 (CVSS 9.9, authenticated code injection through eval/exec), with the same upgrade-to-1.13.0 fix. A further IBM bulletin adds CVE-2026-107327 (CVSS 9.9, authenticated code execution due to missing authorization, Langflow OSS 1.0.0 through 1.12.4), and another adds CVE-2026-107329 (CVSS 9.9, authenticated code execution through improper control of code generation, same versions).

Why this severity: IBM scores CVE-2026-110186 (unauthenticated code execution) and CVE-2026-93680 (authentication bypass) CVSS 3.1 9.8; CVE-2026-110193, -110196, -110244 and -110309 score 8.8 and need a low-privileged account; companion bulletins score CVE-2026-104339 9.8 (no authentication) and CVE-2026-107328 9.9 (authenticated, scope changed); no in-the-wild exploitation reported yet. Langflow has had earlier bugs added to CISA KEV.

Started

Oct 28, 2026

CVEs

CVE-2026-110186CVE-2026-93680CVE-2026-104339CVE-2026-107328CVE-2026-107327CVE-2026-107329CVE-2026-110193CVE-2026-110196CVE-2026-110244CVE-2026-110309CVE-2026-110245CVE-2026-110190CVE-2026-110192CVE-2026-110200

• Python
• AI / LLM tooling
• Langflow
• IBM
• RCE
• Auth bypass
• MCP