L3 · ShartedLangflow · RCE · authenticationlangflow-october-bulletin

Langflow bulletin discloses unauthenticated RCE and auth bypass; upgrade to 1.13.0

IBM discloses critical unauthenticated code execution and authentication bypass affecting Langflow OSS 1.0.0–1.12.8, alongside authenticated issues and Hono dependency flaws. Upgrade to 1.13.0 after backing up data and preparing password sign-in.

Disclosed: Oct 28, 2026; Updated Nov 4, 2026
Severity: CVSS 9.8 × 2; 7 CVEs tracked here
Splash zone: Langflow OSS 1.0.0–1.12.8; critical remote paths need no login, while other issues have narrower prerequisites; python · langflow
In the wild: Unknown; The cited vendor bulletin does not confirm real-world exploitation.

What happened

IBM’s October 28 bulletin is the disclosure tracked here, with the October 29 clarification incorporated. The 1.13.0 release already existed on October 22. The bulletin combines four Langflow product CVEs with three older Hono dependency CVEs; it does not establish that every deployment exposes every dependency path. Hono’s underlying fixes are in 4.13.5, while IBM’s product remediation is Langflow 1.13.0. Upgrade the application rather than substituting an unverified dependency-only change.

The critical product vectors require no credentials; Agentic Assistant code execution and the credential-disclosure CVE require authenticated access. The bulletin’s summary also mentions API-key access without intended authorization, while the credential CVE’s vector requires low privileges; do not generalize that path to all anonymous users. No exact exploit endpoint, confirmed victim count or real-world exploitation is established by the cited bulletin. L3 reflects a mainstream AI workflow server and serious disclosed attack paths.

November 4 backport release: Upstream published 1.12.9 at 01:39:07 UTC, after the 1.13.0 release ceased to be the GitHub latest badge. Its merged changes cover MCP credentials/destinations, generated-component restrictions and image dependencies. Storage namespace isolation was deferred; Python 3.10 retains older Pillow/filelock lines. These are concrete new protections, but the reviewed release/PRs do not establish equivalence to every CVE in IBM’s October bulletin. The verified 1.13.0 upgrade recommendation, data-preservation and password preparation steps remain in force. Source-release availability is not proof that every deployed image has been rebuilt or scanned.

November 4 follow-up release: Langflow published 1.13.1 at 03:14:15 UTC. Its release includes storage namespace isolation that 1.12.9 deferred, alongside further MCP/component and dependency protections. The original bulletin’s 1.13.0 remediation threshold is preserved; 1.13.1 adds protections beyond that baseline. The release and merged PRs do not guarantee all images are available or free of vulnerabilities, and Python 3.10 dependency exceptions still require attention.

What’s in the bowl

CVE-2026-93680CVSS 9.8

Authentication bypass

Remote access without credentials can bypass authentication restrictions; IBM describes incomplete auto-login remediation.

CVE-2026-110186CVSS 9.8

Unauthenticated code execution

Remote code execution without credentials; the bulletin describes an MCP tool-enumeration attack surface.

CVE-2026-110193CVSS 8.8

Agentic Assistant code execution

A low-privileged authenticated user can submit or generate component code through unblocked patterns and execute OS commands.

CVE-2026-110192CVSS 6.5

Insufficiently protected credentials

Authenticated remote access may disclose sensitive information; the bulletin also discusses operator-injected API key exposure.

CVE-2026-84363CVSS 5.9

Hono query and cache interpretation mismatch

A literal URL fragment passed by the runtime/intermediary can hide query parameters from filters and cache keys. Fragment-stripping paths, including Cloudflare Workers, are outside this Hono exposure.

CVE-2026-84364CVSS 5.3

Hono dot-notation memory exhaustion

Only endpoints enabling non-default dot-notation body parsing are affected; nested form fields can exhaust memory.

CVE-2026-84365CVSS 6.5

Hono static-generation traversal

Build-time SSG can write outside its output directory when ssgParams are untrusted; ordinary request routing and fully developer-controlled parameters are outside scope.

Fixed versions

Product	Safe from	Note
Langflow OSS	`1.13.0`	IBM recommended product fix
Langflow additional storage and MCP protections	`1.13.1`	Follow-up source release; IBM bulletin baseline remains 1.13.0

Crime-scene timeline

Oct 22, 2026
Langflow 1.13.0 release is available
Oct 28, 2026
IBM initially publishes the multi-vulnerability bulletin
Oct 29, 2026
IBM clarifies remediation and publishes product CVE records
Nov 4, 01:39 UTC
Langflow publishes a 1.12.9 backport release
The source release includes MCP, component-policy and image dependency changes; the reviewed material does not map it to all seven IBM bulletin CVEs. The 1.13.0 product remediation remains the verified recommendation.
Nov 4, 03:14 UTC
Langflow releases 1.13.1 with additional security protections
The release includes user/flow storage namespace isolation deferred from 1.12.9, plus MCP, component-policy and dependency changes. IBM’s verified bulletin remediation threshold remains 1.13.0.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

IBM Langflow security bulletinPrimaryInitially published October 28, updated October 29; seven listed CVEs and product upgrade to 1.13.0.
Langflow installation and upgrade preparationPrimaryAuto-login transition and existing-account preparation; avoid data-destructive access recovery.
Langflow Docker upgrade guidePrimaryConfiguration and data-location checks required before replacing containers.
Langflow 1.13.0 releasePrimaryRelease availability predates the IBM disclosure; patch date is not the incident disclosure date.
Langflow 1.12.9 original releasePrimarySource release published November 4 at 01:39:07 UTC; links the backport and lxml/Mako changes.
Langflow merged backport PR 16119PrimaryMCP, generated-component, login and dependency protections; storage isolation deferred and Python 3.10 dependency caveats. Not a complete mapping to IBM’s seven CVEs.
Langflow merged image dependency PR 16123Primarylxml built against system libraries and Mako security floor; upstream PR describes verification limits rather than a blanket image-safety guarantee.
Langflow 1.13.1 release metadata and notesPrimaryChecked November 4: v1.13.1 published at 03:14:15 UTC; lists included security changes.
Langflow storage isolation PR 15982PrimarySeparates user and flow namespaces; legacy user files remain readable without migration.
Langflow 1.13.1 image dependency PR 16121PrimaryDependency and system-library changes, Python 3.10 exceptions and unverified image-build/scan coverage.
Langflow 1.13.1 dependency PR 16131PrimaryPython, frontend and documentation dependency updates, some constrained by Python version.

Wipe guide

The wipe checklist

0 of 4 sheets used

Back up and prepare existing sign-in before replacing the deploymentBack up the database, secret key and uploads. For auto-login installations, follow the existing-account password preparation guide before upgrading; setting LANGFLOW_SUPERUSER_PASSWORD alone does not reset an existing non-legacy password. Do not delete or reinstall to recover access.
Install the product upgrade and preserve Docker dataIn the application environment run pip install --upgrade "langflow==1.13.0", or pull langflowai/langflow:1.13.0 and recreate using the vendor upgrade procedure. Mount the path set in LANGFLOW_CONFIG_DIR for the key and uploads; separately keep the database external with LANGFLOW_DATABASE_URL or in that mounted directory with LANGFLOW_SAVE_DB_IN_CONFIG_DIR=true. Move any data still inside the old container before replacing it; a mounted volume alone is insufficient. Keep the existing database backend; pointing SQLite users at a new PostgreSQL database does not migrate their data. Test password sign-in and your flows afterward.
Verify the backport scope before choosing a different branchRead the 1.12.9 release and merged PRs 16119/16123, not only the latest-release badge. They document MCP credential/destination and component controls, dependency updates and deferred storage isolation. Python 3.10 keeps older Pillow/filelock lines. Do not assume the source release or a successful image build proves all seven IBM bulletin CVEs are fixed; the verified product-upgrade instructions above remain applicable.
Evaluate the newer 1.13.1 release with the same backup precautionsRead the 1.13.1 release and PRs 15982/16121/16131. Storage namespaces now separate user uploads from flow attachments; upstream says legacy user files remain readable without migration. Preserve and test existing uploads and flow attachments after upgrade. Python 3.10 dependency exceptions remain. Verify availability of your package or image before selecting it; source publication does not establish that every image is published or vulnerability-free.