AI workflow builders have become a common way for small teams to put together chat assistants, document search and automations without writing everything from scratch. Langflow is one of the best known. A security bulletin from IBM, which handles Langflow's vulnerability reports, now lists two critical flaws that need no login to reach. This guide explains what was reported, who should worry, and how to upgrade and tighten a self-hosted AI tool in a sensible order. It does not describe how to attack anything, and we have not tested the software ourselves.
Self-hosted tools such as Langflow sit on servers your team has to patch and protect. Photo: Kim Scarborough from Chicago, IL, CC BY-SA 2.0, via Wikimedia Commons
The short answer
- What happened: IBM published a security bulletin for Langflow OSS on 28 October 2026. The Hacker News covered it on 2 November.
- The two critical flaws: CVE-2026-93680, an improper authentication flaw, and CVE-2026-110186, a code generation flaw. IBM scores both 9.8 and shows no privileges required.
- Affected versions: 1.0.0 through 1.12.8, according to IBM.
- The fix: Langflow OSS 1.13.0 or later. IBM lists no workarounds.
- What to do: back up, upgrade, turn automatic login off, keep the server off the public internet, and rotate any keys stored in it.
What IBM reported
The bulletin covers several issues. The two that matter most are rated Critical by IBM with a CVSS base score of 9.8 and no privileges needed:
| CVE | IBM's description | CVSS |
|---|---|---|
| CVE-2026-93680 | A remote attacker could bypass security restrictions due to improper authentication | 9.8 |
| CVE-2026-110186 | A remote attacker could execute arbitrary code due to improper control of code generation | 9.8 |
| CVE-2026-110193 | A low-privileged account could make the Agentic Assistant generate or submit component code, resulting in operating system command execution | 8.8 |
| CVE-2026-110192 | A remote authenticated attacker could obtain sensitive information due to insufficiently protected credentials | 6.5 |
IBM's summary also mentions an incomplete remediation of an auto-login security control and unauthenticated remote code execution reachable through Model Context Protocol (MCP) tool enumeration. The bulletin lists several third-party dependency issues as well, and recommends upgrading to the latest version to receive all fixes.
Two details from The Hacker News coverage are worth knowing. First, Langflow 1.13.0 came out on 22 October, and 1.12.8 was released the same day but still has the flaws. Second, the article reports that a public testing module for the authentication bypass exists, and that it only connects, starts a session and lists the tools a server offers, without running commands. Its author lists a narrower set of affected versions than IBM does. Treat the IBM range as the safe one to plan around.
Why this matters to a small or mid-size business
Langflow is not a hosted product with a vendor watching it for you. Many teams run it themselves, on a cloud server or inside Docker, often started as an experiment and then left running. That creates three practical risks.
- The server holds valuable keys. A workflow builder typically stores model API keys, database passwords and tokens for the tools it connects to. Anyone who gets control of the server is a step away from those.
- Prototypes become production. A tool set up for a demo is often exposed to the internet for convenience and never revisited.
- No account is needed. Because the two critical flaws do not require a login, a weak password policy is not your protection. Reachability is.
None of this means AI tools are unsafe to use. It means a self-hosted AI tool is a server like any other and needs patching, access control and monitoring.
What to do this week
Work through these steps in order.
- Find every Langflow instance. Ask developers, check cloud accounts and container lists. Forgotten test servers are the usual surprise.
- Take a backup. The Hacker News coverage advises backing up the database, the secret key and uploaded files before upgrading.
- Upgrade to 1.13.0 or later. For pip installs, upgrade the package to version 1.13.0. For Docker, move to the 1.13.0 image and keep the persistent data volume. Read Langflow's own upgrade guidance first.
- Plan for the login change. Langflow 1.13 is reported to turn automatic login off by default. If your team relied on automatic login, prepare password-based accounts before you upgrade so that nobody is locked out.
- Do not delete and reinstall to regain access. The Hacker News coverage quotes Langflow's documentation as warning that this can permanently remove your flows. Follow the recovery steps instead.
- Take the server off the open internet. Put it behind a VPN or an access proxy, or restrict it to known IP addresses. A tool used by three people does not need to be reachable by everyone.
- Rotate secrets that lived in it. Model API keys, database passwords and any connected service tokens should be treated as exposed if the server was reachable before patching. Our guide to rotating secrets after a breach gives a sensible order, and our post on restricted API keys shows how to limit what a leaked key can do.
- Review logs. Look for sign-ins or tool activity you do not recognize, and ask your IT provider to keep logs for the period before the upgrade.
If you want a second pair of eyes on how your AI workflows and their keys are set up, our AI automation service covers secure deployment and access.
A decision guide
- You run Langflow 1.12.8 or older and it is reachable from the internet: treat it as urgent. Restrict access now, then upgrade and rotate keys.
- You run it only on a private network: upgrade this week, still turn automatic login off, and keep an inventory.
- You are not sure whether anyone runs it: search first. An unknown instance is the riskiest kind.
- You do not need it any more: shut it down and delete the stored credentials.
- You cannot upgrade yet: IBM lists no workaround. Reduce exposure by blocking public access, and set a date to upgrade.
Common mistakes to avoid
Moving to the latest 1.12 release. Version 1.12.8 is listed as affected. The fix is 1.13.0 or later.
Assuming a login screen protects you. The critical flaws are described as needing no account, so rely on network restrictions as well.
Leaving automatic login on. Langflow's own description warns that it should only be used in development environments.
Upgrading without a backup. A failed upgrade or a locked-out account is much easier to fix when the data and secret key are safely copied.
Forgetting the keys. Patching closes the door but does not undo what may have happened before. Rotate anything the server could read.
Treating "not in CISA's list" as "safe". The Hacker News reported that the two flaws were not in the catalog as of 30 October, but the same article notes that six other Langflow flaws are listed. Attention from attackers to this product is not new.
Checklist for your team
- Make a list of every Langflow server, including test and demo ones.
- Back up the database, the secret key and uploaded files.
- Upgrade to Langflow 1.13.0 or later.
- Turn automatic login off and create password-based accounts first.
- Put the server behind a VPN or access proxy, or restrict it by IP address.
- Rotate model API keys, database passwords and tokens stored in it.
- Give each AI service its own limited key with spending alerts.
- Check sign-in and activity logs for anything unfamiliar.
- Shut down instances nobody uses.
- Set a monthly reminder to check for new Langflow releases.
Key takeaways
- IBM's 28 October 2026 bulletin lists two critical Langflow flaws, CVE-2026-93680 and CVE-2026-110186, rated 9.8 with no privileges required.
- Versions 1.0.0 through 1.12.8 are affected, and IBM names no workaround. The fix is 1.13.0 or later.
- The Hacker News reported that neither flaw was in CISA's exploited list as of 30 October, but a public testing module is reported to exist.
- Back up before upgrading, and do not delete and reinstall to recover access.
- Treat a self-hosted AI tool like any other server: patch it, restrict who can reach it and rotate the keys it holds.
Want help hardening your AI tools and the keys behind them? Look at our AI automation service, our custom software development service or talk to our team.
Sources
- IBM Support: Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (28 October 2026)
- The Hacker News: Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers (2 November 2026)
Last reviewed 2 November 2026. This article is general information, not a guarantee of protection. Details come from the vendor bulletin and a news report and may change.
