IBM patches critical flaws in Langflow enabling authentication bypass and RCE
Security updates address four vulnerabilities with scores up to 9.8 CVSS, affecting versions through 1.12.8
IBM has released security patches for Langflow, an open-source framework used by enterprises to build AI agents and retrieval-augmented generation systems without coding knowledge. The latest fixes resolve four critical vulnerabilities that could allow attackers to bypass authentication, steal API credentials, or execute arbitrary code on servers running the platform.
Exploited in the Wild
Langflow is widely adopted because it provides a visual interface for creating complex workflows powered by large language models. However, its popularity has made it a target for cybercriminals who have successfully exploited weaknesses in previous versions to access sensitive developer and AI credentials.
Recent incidents include an active exploitation campaign identified last month and another major breach discovered in August. IBM confirmed that these latest patches address four specific vulnerabilities, two of which are rated critical with a 9.8 CVSS score.
Technical Details
One high-severity flaw, tracked as CVE-2026-110193, allows code and command execution on the server but requires authentication using at least a low-privileged account to exploit. A third vulnerability, CVE-2026-110186, enables unauthenticated remote attackers to execute arbitrary code through Model Context Protocol tool enumeration.
The fourth issue, CVE-2026-93680, stems from an incomplete fix for a prior auto-login security problem and permits attackers to bypass restrictions to access features normally reserved for authenticated users. The final flaw, CVE-2026-110192, is an information disclosure vulnerability caused by insufficiently protected API credentials with a 6.5 CVSS score.
Remediation Steps
The affected versions range from 1.0.0 to 1.12.8, while the security fixes are included in version 1.13.0. Users can obtain the update via the PyPI repository or as a Docker image. IBM issued specific warnings for organizations managing these systems:
- Back up the database, secret key, and uploaded files before upgrading.
- If using automatic login, prepare existing accounts to support password sign-in according to installation and Docker upgrade instructions.
In addition to Langflow updates, IBM also released patches for three medium-severity flaws in Hono, an API and web application framework used internally by Langflow for routing and server tasks. The company advises upgrading Hono to version 4.13.5 immediately.
