---
title: Langflow 1.13.0 fixes two 9.8 flaws reachable with no account, including unauthenticated RCE through MCP tool enumeration; every release from 1.0.0 to 1.12.8 is affected | ctxsec
url: https://ctxsec.com/items/langflow-1-13-0-cve-2026-93680-110186-unauth-mcp-rce
description: "IBM's Oct 28 bulletin for Langflow OSS lists CVE-2026-93680 (authentication bypass, 9.8), CVE-2026-110186 (code injection, 9.8), CVE-2026-110193 (low-privileged user can make the Agentic Assistant run OS commands, 8.8) and CVE-2026-110192 (credential exposure, 6.5), affecting 1.0.0 through 1.12.8. IBM describes one issue as unauthenticated RCE exploitable through Model Context Protocol tool enumeration and another as an incomplete fix for the auto-login control. The only fix is 1.13.0, which turns auto-login off by default. A public Metasploit module already uses CVE-2026-93680 to list a server's MCP tools without credentials."
status: "official (IBM security bulletin, Oct 28); not in CISA KEV; public Metasploit module enumerates MCP tools only"
published: 2026-11-02
---

> IBM's Oct 28 bulletin for Langflow OSS lists CVE-2026-93680 (authentication bypass, 9.8), CVE-2026-110186 (code injection, 9.8), CVE-2026-110193 (low-privileged user can make the Agentic Assistant run OS commands, 8.8) and CVE-2026-110192 (credential exposure, 6.5), affecting 1.0.0 through 1.12.8. IBM describes one issue as unauthenticated RCE exploitable through Model Context Protocol tool enumeration and another as an incomplete fix for the auto-login control. The only fix is 1.13.0, which turns auto-login off by default. A public Metasploit module already uses CVE-2026-93680 to list a server's MCP tools without credentials.

[← Context & Harness Attacks](/context) · [markdown](/items/langflow-1-13-0-cve-2026-93680-110186-unauth-mcp-rce.md)

official (IBM security bulletin, Oct 28); not in CISA KEV; public Metasploit module enumerates MCP tools only

2026-11-02

### Langflow 1.13.0 fixes two 9.8 flaws reachable with no account, including unauthenticated RCE through MCP tool enumeration; every release from 1.0.0 to 1.12.8 is affected

IBM, which handles Langflow's vulnerability reports, published a bulletin on **Oct 28** covering Langflow OSS **1.0.0 through 1.12.8**:

- **CVE-2026-93680** (CVSS 9.8, no account): authentication bypass. IBM's summary calls one issue an "incomplete remediation of an auto-login security control."
- **CVE-2026-110186** (9.8, no account): code execution through improper control of code generation. IBM's summary describes "unauthenticated remote code execution exploitable through model context protocol tool enumeration."
- **CVE-2026-110193** (8.8, low-privileged account): the Agentic Assistant can be made to generate or submit component code that runs OS commands on the server.
- **CVE-2026-110192** (6.5): operator-injected API keys exposed without intended authorization.

A **Metasploit** auxiliary module for CVE-2026-93680 connects to Langflow's MCP endpoint without credentials, opens a session and lists the tools the server exposes; it does not run commands. Langflow's `LANGFLOW_AUTO_LOGIN` setting, which signs everyone in as a superuser, was still on by default in 1.12.8 and is off by default in **1.13.0** (released Oct 22). IBM gives no workaround, and none of these is in CISA KEV as of the Oct 30 catalog. Langflow has had six earlier flaws added to KEV.

**What to do:** back up the database, secret key and uploads, prepare accounts for password sign-in if you relied on auto-login, then upgrade with `pip install --upgrade "langflow==1.13.0"` or the `langflowai/langflow:1.13.0` image. Until then, keep Langflow and its `/api/v1/mcp` endpoints off the internet and rotate any API keys stored in flows.

Sources: [IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (Oct 28)](https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2) · [Langflow v1.13.0 release](https://github.com/langflow-ai/langflow/releases/tag/v1.13.0) · [Metasploit module langflow_auth_bypass_cve_2026_93680](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/langflow_auth_bypass_cve_2026_93680.rb) · [The Hacker News: Critical Langflow flaws (Nov 2)](https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html)