# Langflow OSS: unauthenticated RCE and auth bypass (CVE-2026-110186, CVE-2026-93680), fixed in 1.13.0 · pwn.watch

> IBM published a security bulletin on Oct 28 2026 for Langflow OSS 1.0.0 through 1.12.8, the open source AI workflow builder. It covers an unauthenticated remote code execution flaw (CVE-2026-110186, CVSS 9.8) that IBM says is exploitable through model context protocol tool enumeration, an incomplete fix of the auto-login security control that allows an authentication bypass (CVE-2026-93680, CVSS 9.8), several authenticated code execution bugs (CVSS 8.8), API key exposure, path traversal, and vulnerable bundled dependencies such as Hono. The fix is to upgrade to Langflow OSS 1.13.0 or later; IBM lists no workarounds. Companion IBM bulletins for Langflow OSS add CVE-2026-104339 (CVSS 9.8, unauthenticated OS command injection leading to code execution) and CVE-2026-107328 (CVSS 9.9, authenticated code injection through eval/exec), with the same upgrade-to-1.13.0 fix. A further IBM bulletin adds CVE-2026-107327 (CVSS 9.9, authenticated code execution due to missing authorization, Langflow OSS 1.0.0 through 1.12.4), and another adds CVE-2026-107329 (CVSS 9.9, authenticated code execution through improper control of code generation, same versions).

Page: https://pwn.watch/i/langflow-oss-multiple-rce-cve-2026-110186-oct-2026 · generated 2026-10-29T20:46:10.933Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Langflow OSS
- Started: 2026-10-28
- CVEs: CVE-2026-110186, CVE-2026-93680, CVE-2026-104339, CVE-2026-107328, CVE-2026-107327, CVE-2026-107329, CVE-2026-110193, CVE-2026-110196, CVE-2026-110244, CVE-2026-110309, CVE-2026-110245, CVE-2026-110190, CVE-2026-110192, CVE-2026-110200
- Affected: Langflow OSS 1.0.0 through 1.12.8 (some of the CVEs only through 1.12.4)
- Fixed in: 1.13.0

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/langflow-oss-multiple-rce-cve-2026-110186-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/langflow-oss-multiple-rce-cve-2026-110186-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/langflow-oss-multiple-rce-cve-2026-110186-oct-2026.json
- This file: https://pwn.watch/i/langflow-oss-multiple-rce-cve-2026-110186-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-29: IBM's CNA publishes the CVE records, including CVE-2026-110186 (CVSS 9.8, code injection, no authentication required). (https://www.cve.org/CVERecord?id=CVE-2026-110186)
- 2026-10-28: IBM publishes a security bulletin listing unauthenticated RCE, an auto-login authentication bypass, authenticated code execution, credential exposure and dependency flaws in Langflow OSS 1.0.0 through 1.12.8, and says to upgrade to 1.13.0 or later. (https://www.ibm.com/support/pages/node/7294467)
- 2026-10-22: Langflow releases v1.13.0, the version IBM later names as the fix. (https://github.com/langflow-ai/langflow/releases/tag/v1.13.0)

## Fix brief
# Security brief: Langflow OSS: unauthenticated RCE and auth bypass (CVE-2026-110186, CVE-2026-93680), fixed in 1.13.0

Source: https://pwn.watch/i/langflow-oss-multiple-rce-cve-2026-110186-oct-2026 · status: live · severity: critical · updated Oct 29, 2026, 16:24 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
IBM published a security bulletin on Oct 28 2026 for Langflow OSS 1.0.0 through 1.12.8, the open source AI workflow builder. It covers an unauthenticated remote code execution flaw (CVE-2026-110186, CVSS 9.8) that IBM says is exploitable through model context protocol tool enumeration, an incomplete fix of the auto-login security control that allows an authentication bypass (CVE-2026-93680, CVSS 9.8), several authenticated code execution bugs (CVSS 8.8), API key exposure, path traversal, and vulnerable bundled dependencies such as Hono. The fix is to upgrade to Langflow OSS 1.13.0 or later; IBM lists no workarounds. Companion IBM bulletins for Langflow OSS add CVE-2026-104339 (CVSS 9.8, unauthenticated OS command injection leading to code execution) and CVE-2026-107328 (CVSS 9.9, authenticated code injection through eval/exec), with the same upgrade-to-1.13.0 fix. A further IBM bulletin adds CVE-2026-107327 (CVSS 9.9, authenticated code execution due to missing authorization, Langflow OSS 1.0.0 through 1.12.4), and another adds CVE-2026-107329 (CVSS 9.9, authenticated code execution through improper control of code generation, same versions).

Severity detail: IBM scores CVE-2026-110186 (unauthenticated code execution) and CVE-2026-93680 (authentication bypass) CVSS 3.1 9.8; CVE-2026-110193, -110196, -110244 and -110309 score 8.8 and need a low-privileged account; companion bulletins score CVE-2026-104339 9.8 (no authentication) and CVE-2026-107328 9.9 (authenticated, scope changed); no in-the-wild exploitation reported yet. Langflow has had earlier bugs added to CISA KEV.

- Product: Langflow OSS
- CVE / advisory ids: CVE-2026-110186, CVE-2026-93680, CVE-2026-104339, CVE-2026-107328, CVE-2026-107327, CVE-2026-107329, CVE-2026-110193, CVE-2026-110196, CVE-2026-110244, CVE-2026-110309, CVE-2026-110245, CVE-2026-110190, CVE-2026-110192, CVE-2026-110200

## Affected versions
- Langflow OSS 1.0.0 through 1.12.8 (some of the CVEs only through 1.12.4)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 1.13.0

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
If you run Langflow, upgrade to 1.13.0 or later now (pip install langflow --upgrade, or pull the latest Docker image). Don't expose Langflow to the internet without authentication in front of it, and rotate any API keys stored in Langflow flows if your instance was reachable.

## Latest updates
- Oct 29, 2026: IBM's CNA publishes the CVE records, including CVE-2026-110186 (CVSS 9.8, code injection, no authentication required).
- Oct 28, 2026: IBM publishes a security bulletin listing unauthenticated RCE, an auto-login authentication bypass, authenticated code execution, credential exposure and dependency flaws in Langflow OSS 1.0.0 through 1.12.8, and says to upgrade to 1.13.0 or later.
- Oct 22, 2026: Langflow releases v1.13.0, the version IBM later names as the fix.

## Advisories
- [Security Bulletin: Langflow OSS (CVE-2026-107327, CVE-2026-107329)](https://www.ibm.com/support/pages/node/7293016) (IBM)
- [Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (CVE-2026-104339 and others)](https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-0) (IBM)
- [Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (CVE-2026-107328 and others)](https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-1) (IBM)
- [Security Bulletin: Langflow OSS is affected by multiple vulnerabilities](https://www.ibm.com/support/pages/node/7294467) (IBM)
- [CVE-2026-110186](https://www.cve.org/CVERecord?id=CVE-2026-110186) (CVE.org)
- [NVD: CVE-2026-110186](https://nvd.nist.gov/vuln/detail/CVE-2026-110186) (NVD)
- [Langflow v1.13.0](https://github.com/langflow-ai/langflow/releases/tag/v1.13.0) (Langflow)

---
Machine-readable: https://pwn.watch/i/langflow-oss-multiple-rce-cve-2026-110186-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.