In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

Vulnerability summary

Per the vendor advisory, IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (Oct 28, 2026), checked .

CVE
CVE-2026-110186, CVE-2026-93680, CVE-2026-110193, CVE-2026-110192
Exploited?
No attacks reported. CISA's enrichment of the CVE-2026-110186, CVE-2026-93680 and CVE-2026-110193 records lists exploitation as none, and none of these CVEs is in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.29).

Who is affected and what fixes it

Who is affected and what fixes it, per the vendor advisory
ProductAffectedFixed inSource
Langflow OSS (pip or Docker)1.0.0 through 1.12.81.13.0 or laterIBM bulletin, checked
CVE-2026-110186 (code execution, no login, 9.8)1.0.0 through 1.12.81.13.0CVE-2026-110186, checked
CVE-2026-93680 (authentication bypass, 9.8)1.0.0 through 1.12.81.13.0CVE-2026-93680, checked
CVE-2026-110193 (Agentic Assistant command execution, low-privilege login, 8.8)1.0.0 through 1.12.81.13.0IBM bulletin, checked
CVE-2026-110192 (API credential exposure, 6.5)1.0.0 through 1.12.81.13.0IBM bulletin, checked

Patch checklist

  1. Check your version: pip show langflow, or the image tag of your langflowai/langflow container.
  2. Back up the database, the secret key and uploaded files first, as IBM's bulletin asks.
  3. If you use automatic login, set up a password sign-in for the existing account before upgrading, per Langflow's upgrade instructions.
  4. pip: pip install --upgrade "langflow==1.13.0". Docker: pull langflowai/langflow:1.13.0 and restart, keeping your persistent data.
  5. Our tip: don't leave Langflow reachable from the internet without a login in front of it, and rotate API keys stored in Langflow if it was exposed.

If you can't update yet

  • IBM lists no workaround: "None."
  • Our tip: take the instance off the public internet or put it behind a VPN or authenticating proxy until you can upgrade.

How to check for compromise

Not confirmed, check the vendor advisory.

Full steps and context: What to do now

TL;DR: IBM says Langflow OSS, the open-source visual builder for AI agents and workflows, has four new flaws in versions 1.0.0 through 1.12.8. Two are rated critical (9.8): CVE-2026-110186 lets an attacker run code with no login, and CVE-2026-93680 bypasses authentication. The fix is Langflow 1.13.0, released October 22, 2026. IBM lists no workaround. No attacks have been reported.

What happened

IBM published a security bulletin for Langflow OSS on October 28, 2026, and the CVE records went public on October 29 at 15:15 UTC (11:15 p.m. Manila). In IBM’s words, the issues include “an incomplete remediation of an auto-login security control, agentic code execution via a third-party library, operator-injected API key exposure reachable without intended authorization, and unauthenticated remote code execution exploitable through model context protocol tool enumeration.”

The four Langflow CVEs, with IBM’s scores:

  • CVE-2026-110186 (9.8, critical): remote code execution with no login needed.
  • CVE-2026-93680 (9.8, critical): authentication bypass.
  • CVE-2026-110193 (8.8, high): someone with a low-privilege account can get the Agentic Assistant to produce code that runs operating system commands on the server.
  • CVE-2026-110192 (6.5, medium): a logged-in user can read API credentials.

The bulletin also lists three flaws in Hono, a JavaScript web framework Langflow ships (CVE-2026-84363, CVE-2026-84364, CVE-2026-84365, fixed in Hono 4.13.5).

Langflow 1.13.0 went up on PyPI on October 22, 2026, at 21:20 UTC, about four hours after 1.12.8. It’s still the latest stable release at our check; a 1.13.1 release candidate is on PyPI.

This is IBM’s fourth Langflow bulletin this month, after one on October 2 and two on October 19. Two flaws fixed earlier are also covered: CVE-2026-104339 (9.8, command injection with no login; affects through 1.12.3, fixed in 1.12.4) and CVE-2026-107327 (9.9, code execution for logged-in users; affects through 1.12.4, fixed in 1.12.5), each in one of IBM’s October 19 bulletins. Upgrading to 1.13.0 includes those.

Why it matters

Our read: Langflow often holds the keys to everything an agent touches: model API keys, database logins and connectors. A flaw that runs code without a login on an internet-facing Langflow server can expose all of them. Small teams often run Langflow on a single cloud VM or in Docker for prototypes and leave it running. Attackers have gone after Langflow before: CISA’s KEV catalog already lists six earlier Langflow flaws as exploited, most recently CVE-2026-9198 (added August 4, 2026). Agent tools have been a steady target this month.

What to do now

  1. Find every Langflow instance you or your team run, including test servers.
  2. Back up the database, secret key and uploaded files.
  3. Upgrade to 1.13.0. pip: pip install --upgrade "langflow==1.13.0". Docker: langflowai/langflow:1.13.0. If you use automatic login, prepare a password login for the existing account first, as Langflow’s upgrade instructions describe.
  4. Our tip: if an instance was reachable from the internet, rotate the API keys and credentials stored in it, and check its logs for unknown flows or users.
  5. Keep it private. Our tip: put Langflow behind a VPN or a login proxy rather than exposing it directly.

Sources & method

Source What it confirms Link
IBM Security Bulletin (Oct 28, 2026, updated Oct 29) Four Langflow CVEs, scores, 1.0.0–1.12.8 affected, fix 1.13.0, no workaround IBM
IBM Security Bulletin (Oct 19, 2026) Earlier bulletin: 1.0.0–1.12.4 affected, fix 1.12.5, includes CVE-2026-107327 IBM
IBM Security Bulletin (Oct 19, 2026) Earlier bulletin: 1.0.0–1.12.3 affected, fix 1.12.4, includes CVE-2026-104339 IBM
IBM Security Bulletin (Oct 2, 2026) Earlier bulletin: 1.0.0–1.12.2 affected, fix 1.12.3 IBM
CVE-2026-110186 record (IBM CNA, published Oct 29, 2026) 9.8, 1.0.0 through 1.12.8, upgrade to 1.13.0 cve.org
CVE-2026-93680 record (IBM CNA) 9.8 authentication bypass, same range cve.org
CVE-2026-104339 record 9.8, through 1.12.3, fixed 1.12.4; CISA lists exploitation as none (as for 110186, 93680 and 110193) cve.org
CVE-2026-107327 record 9.9, through 1.12.4, fixed 1.12.5 cve.org
PyPI: langflow 1.13.0 uploaded Oct 22, 2026, 21:20 UTC PyPI
Langflow releases Release notes GitHub
CISA KEV (version 2026.10.29) None of these CVEs listed; six earlier Langflow flaws listed, latest CVE-2026-9198 (added Aug 4, 2026) CISA

Last checked: Oct 30, 2026, 1:00 p.m. Manila (UTC+8). Method: We read IBM’s bulletins and the CVE records IBM published as CNA, checked release dates on PyPI and checked CISA’s KEV catalog. Tips marked “Our tip” and analysis marked “Our read” are ours. No affiliate links. How we work.

Updates

  • Oct 30, 2026, 4:30 p.m. Manila: First published.

Spotted an error? See our corrections policy and tell us.