IBM Discloses Critical Langflow Vulnerabilities for Remote Code Execution

Original title: Critical Langflow AI Vulnerabilities Allow Hackers to Execute Remote Code Without Authentication

GBHackersby DivyaNov 3, 2026 · 06:12 UTC (23h ago)2 min read

AI summary · x-ai/grok-4.7Summaries by Vani AI

Seven vulnerabilities in Langflow versions 1.0.0-1.12.8 fixed in 1.13.0, including unauthenticated RCE with CVSS 9.8.

IBM disclosed seven vulnerabilities in Langflow OSS, including authentication bypass and arbitrary code execution flaws exploitable remotely without credentials. The issues affect versions 1.0.0 through 1.12.8 and are fixed in 1.13.0. CVEs include CVE-2026-93680 for authentication bypass and CVE-2026-110186 for unauthenticated RCE. Additional issues in the Hono framework dependency are fixed in Hono 4.13.5. Cryptomining attacks have previously exploited an older vulnerability in Langflow.

Key facts

Unauthenticated RCE and authentication bypass with CVSS 9.8
Hono dependency flaws fixed in version 4.13.5
Upgrade to Langflow 1.13.0 recommended
Backup database, secret key and files before upgrading

Security assessment · AI, from the articleNo known exploitation

Impact: Remote code execution without authentication

What to do

1.Upgrade to Langflow 1.13.0
2.Back up database, secret key and uploaded files
3.Verify persistent storage for Docker deployments

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-93680 CVE-2026-110186 CVE-2026-110193 CVE-2026-110192 CVE-2026-84363 CVE-2026-84364 CVE-2026-84365

Tags: langflow ibm rce authentication-bypass

Vendors: IBM
Products: Langflow

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-93680 +3 related CVEs CVE-2026-110186 CVE-2026-110193 CVE-2026-110192	Authentication bypass in IBM Langflow OSS 1.0.0–1.12.8	9.8 group max	2%	PoC	5d ago
CVE-2026-84365 +2 related CVEs CVE-2026-84363 CVE-2026-84364	Hono: The fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the…	6.5 group max	<1%		Sep 1, 2026

From the original article

2 min read at gbhackers.com

IBM has disclosed seven vulnerabilities in Langflow OSS, including critical flaws such as authentication bypass and code injection that attackers can exploit remotely without credentials. The bulletin addresses Langflow versions 1. 0.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.