Langflow OSS 1.0.0 to 1.12.8 ships with automatic login enabled by default. A single unauthenticated request to `/api/v1/auto_login` returns a superuser session. That session allows access to Langflow’s MCP endpoint. Attackers can then execute custom component code on the server. CVE-2026-93680 and CVE-2026-110186 are both rated 9.8 Critical. CVE-2026-110193 allows low-privileged accounts to reach OS command execution. CVE-2026-110192 exposes operator-injected API keys. Langflow 1.13.0 fixes all flaws by disabling automatic login by default. No workarounds exist beyond upgrading. No exploitation has been reported as of November 2, 2026. A prior flaw, CVE-2025-3248, was exploited in ransomware campaigns. IBM’s bulletin confirms the only fix is version 1.13.0.
What changed
Langflow OSS 1.0.0 to 1.12.8 had automatic login enabled by default, allowing unauthenticated superuser sessions.
What it unlocks
Unauthenticated attackers can gain superuser sessions and execute arbitrary code on the server via MCP tools.
- CVE-2026-93680 scored 9.8 Critical
- CVE-2026-110186 scored 9.8 Critical
- CVE-2026-110193 scored 8.8
- CVE-2026-110192 scored 6.5
What you need to act on it
- Langflow OSS 1.0.0 to 1.12.8 installed
- Instance reachable by untrusted parties
- AUTO_LOGIN not explicitly disabled
Sources