Critical · 1 source · latest 1h

IBM patches critical Langflow flaws enabling authentication bypass and code execution

CRITICAL · VULNERABILITYIBMredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

Langflow OSS 1.0.0 to 1.12.8 is affected by CVE-2026-93680 (authentication bypass, incomplete fix of a prior auto-login issue, CVSS 9.8), CVE-2026-110186 (unauthenticated RCE via MCP tool enumeration, CVSS 9.8), CVE-2026-110193 (high-severity code and command execution via a third-party library in the Agentic Assistant, requires at least a low-privileged account) and CVE-2026-110192 (information disclosure from insufficiently protected API credentials, CVSS 6.5). Upgrade to 1.13.0 and back up the database, secret key and uploaded files first. Also upgrade Hono to 4.13.5 to address three medium-severity flaws.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Upgrade Langflow OSS to version 1.13.0, available from PyPI or as a Docker image.
Back up the database, secret key and uploaded files before upgrading.
If the deployment uses automatic login, prepare the existing account for password sign-in as described in IBM's upgrade instructions.
Upgrade Hono to version 4.13.5.

Written by AI from the sources, checked against them

Read the full story at the source