IBM Patches Critical RCE and Authentication Bypass Flaws in Langflow

IBM has released critical security patches for Langflow, an open-source framework used to build AI agents and large language model (LLM) workflows, to address vulnerabilities that could allow unauthenticated remote code execution (RCE) and authentication bypass.

The patches address four distinct vulnerabilities, two of which carry a critical CVSS score of 9.8. The flaws pose a significant risk to enterprise environments that use Langflow for creating retrieval-augmented generation (RAG) systems and low-code AI agents.

Technical Details of the Vulnerabilities

The most severe flaw, tracked as CVE-2026-110186, allows unauthenticated remote attackers to execute arbitrary code through Model Context Protocol (MCP) tool enumeration. Another critical issue, CVE-2026-93680, results from an incomplete fix for a previous auto-login security problem, enabling attackers to bypass security restrictions and access features that normally require authentication.

A third, high-severity vulnerability (CVE-2026-110193) involves a third-party library used by the Agentic Assistant, which can lead to code and command execution on the server if the attacker has at least low-privileged authentication. Additionally, CVE-2026-110192 is an information disclosure flaw that could leak insufficiently protected API credentials.

The framework, which is widely used to create AI agents and workflows, has faced previous security challenges, including critical flaws allowing remote code execution. Vulnerabilities in Langflow have been exploited in the wild to steal developer and AI credentials, most recently in August.

Remediation and Mitigation

Langflow OSS versions 1.0.0 through 1.12.8 are affected by these flaws. Users should upgrade to version 1.13.0 immediately, which is available via the PyPI repository and as a Docker image.

IBM advises users to back up their databases, secret keys, and uploaded files before performing the upgrade. If a deployment currently relies on automatic login, administrators should prepare existing accounts for password-based sign-in during the upgrade process.

IBM also released patches for three medium-severity flaws in Hono, the API and web application development framework used for request routing within Langflow. Users are advised to upgrade Hono to version 4.13.5.