IBM patches critical Langflow flaws enabling authentication bypass and RCE
Original title: Critical Langflow flaws enable authentication bypass and RCE
The patches fix four vulnerabilities in Langflow versions 1.0.0 to 1.12.8, including two critical ones rated 9.8 CVSS, and affect Hono framework upgrades.
IBM has patched critical vulnerabilities in Langflow, an open-source framework for building AI agents, LLM-powered workflows, and RAG systems. The flaws allow attackers to bypass authentication, leak API credentials, and execute arbitrary code. The affected versions are 1.0.0 to 1.12.8, fixed in 1.13.0. Additionally, patches were released for three medium-severity flaws in Hono.
- Flaws include CVE-2026-93680 for auth bypass
- CVE-2026-110186 enables unauth RCE
- Fixed in version 1.13.0
- Affects Hono 4.13.5 upgrade
Impact: authentication bypass, API credential leak, arbitrary code execution
- 1.Upgrade to Langflow 1.13.0
- 2.Back up database, secret key, and uploaded files
- 3.Upgrade Hono to version 4.13.5
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-93680+3 related CVEs | Authentication bypass in IBM Langflow OSS 1.0.0–1.12.8 | 9.8 group max | 2% | PoC |
From the original article
1 min read at csoonline.com
IBM patched critical vulnerabilities in Langflow, an open-source framework for building AI agents, LLM-powered workflows, and retrieval-augmented generation (RAG) systems. The flaws could allow attackers to bypass authentication, leak API credentials, and execute arbitrary code.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.