CVE-2026-93680: Langflow 1.13.0 fixes auth bypass

Langflow 1.12.8 dropped on October 22 — same day as 1.13.0 — and it's still vulnerable. CVE-2026-93680 is an authentication bypass hitting every release from 1.0.0 through 1.12.8; 1.13.0 is the fix. Check your deployed package version or Docker image tag, then plan the upgrade. IBM offers no workaround for servers that can't update.

If you're running Langflow to build AI agents and workflows, this isn't just a sign-in problem. IBM rates the bypass and a separate unauthenticated code-execution flaw, CVE-2026-110186, at 9.8 Critical. The report covers IBM's bulletin alongside an upgrade requirement that also changes how users access their existing accounts.

Check and upgrade to 1.13.0 for CVE-2026-93680

Start by verifying the version recorded for the deployed Python package or the Docker image tag — don't assume a recent update closed the issue. NVD's record for CVE-2026-9198 flags versions 1.0.0 up to (but not including) 1.10.1 as affected by that separate code-injection flaw. The bypass and the two newer code-injection flaws affect versions 1.0.0 up to (but not including) 1.13.0.

The Python command below performs an upgrade, not a read-only version check. Finish the backup and account preparation before running it.

1. Back up the database, secret key, and uploaded files. Langflow's upgrade guidance names all three, so don't reduce preparation to saving only the database.

   Verify that all three backup items belong to the deployment being upgraded before proceeding. For Docker, identify the persistent data that must stay attached when swapping the image, rather than treating an image replacement as a fresh install.

2. If the deployment uses automatic login, prepare the existing account for password sign-in using Langflow's upgrade guidance. The new release disables automatic login by default, so account prep belongs before the package or image change.

   Record whether automatic login is currently enabled and confirm the account preparation is done. A version check alone won't tell you whether users are ready for the sign-in behaviour change.

3. For a Python-package deployment, install the fixed version with the documented upgrade command.

   pip install --upgrade "langflow==1.13.0"

   For Docker, change the deployment to the langflowai/langflow:1.13.0 image while retaining its persistent data. These are alternative deployment paths; pick the one your server uses.

4. After the change, verify the deployed package version or image tag again, test password sign-in, and confirm existing flows and uploaded files are still available.

5. If sign-in fails after the upgrade, use the recovery procedure linked from Langflow's upgrade guidance. Don't delete or reinstall Langflow to regain access — its documentation warns that doing so can permanently remove flows.

What the four findings actually allow

IBM's bulletin covers different weaknesses with different account requirements. Keep those distinctions when deciding what an exposed server could permit, rather than treating every finding as unauthenticated command execution.

IBM rates the Agentic Assistant finding at 8.8 High and the credential-exposure finding at 6.5 Medium. Their account requirements distinguish them from the two Critical findings, but the Agentic Assistant issue doesn't require a superuser account — the bulletin specifies a low-privileged account.

NVD classifies CVE-2026-93680 as CWE-287 Improper Authentication, while CVE-2026-110186 and CVE-2026-110193 are CWE-94 Code Injection. These classifications help keep the authentication failure separate from the code-generation and component-code risks.

For CVE-2026-93680, the reported consequence is an authentication bypass. The separate critical finding concerns arbitrary code execution. That distinction matters when interpreting a demonstration: showing access to a server's tools doesn't, by itself, show that commands ran on its operating system.

IBM first published the bulletin on October 28 and updated it the following day. Its affected range includes 1.12.8, even though that version was released on October 22 alongside 1.13.0. The release date alone therefore can't distinguish the vulnerable installation from the fixed one.

Why automatic login changes the migration

Automatic login isn't merely a remembered browser session. When enabled, Langflow signs users in as superusers without requiring them to authenticate. The setting LANGFLOW_AUTO_LOGIN is enabled by default in 1.12.8, and its code description states the intended boundary explicitly.

“bypasses authentication and should only be used in development environments.”

— Langflow's code description for automatic login

Langflow 1.13 switches that default off. For an existing deployment, this connects the security fix directly to account readiness: upgrading the software can also mean moving from automatic access to password sign-in.

Langflow can expose its flows as tools to compatible AI applications through the Model Context Protocol (MCP). IBM describes one flaw as unauthenticated remote code execution through MCP tool enumeration. That makes the MCP-facing behaviour relevant to this bulletin, rather than treating the web sign-in screen as the entire authentication boundary.

Consider the supported use case of an AI application accessing a Langflow flow as an MCP tool. The human operator's password sign-in and the application's access to that tool are different interactions to check. After upgrading such a deployment, I'd verify both account access and the existing MCP integration. A working browser session wouldn't answer whether the application can still use its flow, and a successful tool listing wouldn't establish that the authentication bypass or code-execution findings had been reproduced.

MCP tests leave auto-login-off exposure unresolved

The public Metasploit module doesn't demonstrate server-side command execution. It cites CVE-2026-93680, connects to the MCP endpoint without credentials, starts a session and lists available tools. Its demonstrated behaviour stops at enumeration.

The module was tested against Langflow 1.8.4 with automatic login enabled. Its author lists 1.5.0 through 1.11.4 as affected, which is narrower than IBM's range. For upgrade planning, rely on IBM's affected range; the module author's range is not a safe-version boundary.

That test configuration limits what can be inferred from the demonstration. In particular, the test doesn't resolve the exposure of deployments where automatic login is already disabled.

IBM also describes an incomplete fix to an automatic-login security control, but its bulletin doesn't establish whether disabling automatic login makes an otherwise affected server safe. There is no published workaround in the bulletin. Turning off that setting shouldn't be presented as an equivalent substitute for installing 1.13.0.

As of the November 3 check, CISA doesn't list the new authentication bypass or either of the two code-injection findings in its Known Exploited Vulnerabilities catalog. That's a catalog status, not evidence that exploitation can't occur. Equally, an enumeration module shouldn't be described as proof that these code-execution flaws have been exploited.

The distribution data also identifies one public GitHub repository naming CVE-2026-93680, but labels that public-code information unverified. Keep that evidence separate from the Metasploit module's documented behaviour and CISA's exploitation status: a repository naming a vulnerability does not, on its own, verify its claims.

The older 1.10.1 fix is not today's upgrade target

CVE-2026-9198 is a separate Langflow code-injection vulnerability with a different fixed version. NVD lists 1.10.1 as its fix and versions from 1.0.0 before 1.10.1 as affected. CISA added that older flaw to its known-exploited catalog on August 4.

A deployment updated for that older issue can still fall within the affected range of the October bulletin. Closing an earlier Langflow finding is therefore not enough to establish that the current installation is patched.

The distinction also appears in the dated EPSS data. FIRST's November 2 score is 0.2866 for CVE-2026-9198, compared with 0.0218 for CVE-2026-93680. Treat those figures as prioritisation context, not as grounds to substitute the older vulnerability's fixed version for the release the new bulletin requires.

Prioritise the move to 1.13.0 over any further 1.12 deployment. PyPI listed no later 1.12 release as of November 2, and IBM offers no interim workaround. The practical decision is to prepare the backup and password-access change together, then install the fixed release without risking existing flows through a destructive reinstall.

There's another reason to match each finding to its own fixed version. On October 29, IBM published CVE records for 29 other Langflow flaws, naming 1.12.4 and 1.12.5 as their fixes. None of the 33 records, including the four in this bulletin, lists 1.13.0 as affected — so the question becomes whether your deployment process can reliably track which fix belongs to which flaw.