Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycriticalExploited in the wild

Four Langflow Vulnerabilities Enable Unauthenticated RCE

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Four flaws in Langflow 1.0.0-1.12.8 enable unauthenticated RCE and auth bypass; fixed in 1.13.0.

IBM disclosed four critical vulnerabilities in Langflow versions 1.0.0 to 1.12.8 allowing unauthenticated attackers to bypass authentication, leak credentials, execute code or generate code under low privileges. The issues are fixed in version 1.13.0 released on October 22. Patches were also released for three medium-severity Hono framework flaws.

Key facts
  • Langflow 1.0.0-1.12.8 affected
  • Fixed in 1.13.0 released October 22
  • CVE-2026-93680: auth bypass
  • CVE-2026-110186: unauth RCE
  • CVE-2026-110193: low-priv code gen
  • CVE-2026-110192: credential leak
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026Langflow 1.13.0 released with fixes · The Hacker News
  2. Oct 28, 2026IBM discloses four critical Langflow flaws · The Hacker News
  3. Nov 3, 2026CSO Online reports Hono medium-severity patches · CSO Online

What each outlet adds

beyond the shared facts
  • The Hacker NewsMetasploit module demonstrates exploitation; auto-login enabled by default in 1.12.8
  • CSO OnlineTwo flaws rated 9.8 CVSS; Hono 4.13.5 upgrade affected
CVEs
CVE-2026-93680CVE-2026-110186CVE-2026-110193CVE-2026-110192
Vendors
IBM
Products
Langflow

Coverage

oldest first · one row per article · UTC
  1. · 1d ago The Hacker NewsFirst report

    Critical Langflow Flaws Allow Unauthenticated Code Execution

    Four flaws in Langflow 1.0.0-1.12.8 enable unauthenticated RCE and auth bypass; upgrade to 1.13.0 fixes them.

  2. · 5h ago CSO Online

    IBM patches critical Langflow flaws enabling authentication bypass and RCE

    The patches fix four vulnerabilities in Langflow versions 1.0.0 to 1.12.8, including two critical ones rated 9.8 CVSS, and affect Hono framework upgrades.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-93680
+3 related CVEs
CVE-2026-110186CVE-2026-110193CVE-2026-110192
Authentication bypass in IBM Langflow OSS 1.0.0–1.12.8
9.8
group max
2%PoC