Langflow — Multiple Critical Code Execution and Authentication Bypass Flaws (CVE-2026-9198, CVE-2026-93680)

Publication date: November 02, 2026
Category: Vulnerability / Artificial Intelligence

Introduction

Recent security disclosures released via official vendor bulletins have revealed multiple critical vulnerabilities affecting Langflow, a popular open-source framework utilized for building artificial intelligence agents and data workflows. The discovered flaws impact all Langflow OSS releases spanning from version 1.0.0 through 1.12.8, exposing default deployments to remote code execution (RCE) and security restriction bypasses without requiring prior credentials. Given the extensive adoption of this platform in development and production environments for orchestrating Large Language Models (LLMs), this exposure poses a severe systemic risk.

What is Langflow? (General Analysis)

Langflow functions as a visual interface and Python-based execution engine designed to chain AI components, APIs, and vector databases together. It streamlines the rapid creation of autonomous agent applications. However, due to its underlying architecture—which dynamically processes and evaluates user-defined code blocks and system commands—any weakness in authentication subsystems or input sanitization leads directly to complete server compromise.

The analyzed vulnerabilities encompass officially verified entries in the National Vulnerability Database (NVD):

  • CVE-2026-9198 (CVSS 9.8 - CRITICAL): Chaining of endpoints (/api/v1/auto_login and /api/v1/validate/code) allowing unauthenticated attackers to mint superuser tokens and execute arbitrary code via exec(). (CWE-94, listed in CISA KEV).
  • CVE-2026-93680 (CVSS 9.8 - CRITICAL): Improper authentication flaw permitting security restriction bypasses. (CWE-287).
  • CVE-2026-110186 (CVSS 9.8 - CRITICAL): Improper control of code generation enabling remote code execution. (CWE-94).
  • CVE-2026-110193 (CVSS 8.8 - HIGH): Flaw where low-privileged users can manipulate the agentic assistant to execute operating system commands. (CWE-94).
  • CVE-2026-110192 (CVSS 6.5 - MEDIUM): Insufficiently protected credentials leading to sensitive information disclosure. (CWE-522).
  • CVE-2026-104339 (CVSS 9.8 - CRITICAL): Improper neutralization of special elements used in OS commands across versions 1.0.0 to 1.2.3. (CWE-94).

How Does It Work? (Technical Analysis)

The exploitation mechanism relies on architectural deficiencies within session handling and the Model Context Protocol (MCP):

  • Authentication Bypass and Auto-Login: In default configurations or versions where the LANGFLOW_AUTO_LOGIN parameter is active (enabled by default in version 1.12.8), the application automatically logs network callers in as superusers without prompting for credentials.
  • Tool Enumeration via MCP: Through the Model Context Protocol (MCP), Langflow exposes its data flows as executable tools for external AI applications. Public exploitation modules (such as those in penetration testing frameworks) connect to the MCP endpoint without credentials, initialize sessions, and enumerate exposed server capabilities.
  • Arbitrary Code Execution: Once access is secured via authentication bypasses, attackers interact with code validation endpoints (/api/v1/validate/code), injecting malicious payloads evaluated through internal language functions like exec() or executed directly at the OS level.

“Enabling auto-login functionality by default in production environments transforms a development interface into an open gateway for unauthenticated remote command execution.”

Affected Systems / Environments

All deployments utilizing the following software versions are impacted:

  • Langflow OSS: Versions 1.0.0 through 1.12.8 inclusive.
  • Specific Environments: Servers with the LANGFLOW_AUTO_LOGIN configuration variable enabled, as well as instances exposing MCP endpoints to unsegmented or public networks.

Primary Vulnerabilities Table

CVE Category (CWE) Impact CVSS Vector (Condensed)
CVE-2026-9198 CWE-94 RCE / Superuser 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-93680 CWE-287 Auth Bypass 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-110186 CWE-94 Code Execution 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-110193 CWE-94 OS Command Exec 8.8 (High) AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-110192 CWE-522 Credential Disclosure 6.5 (Medium) AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2026-104339 CWE-94 OS Command Injection 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

The definitive resolution provided by the vendor is upgrading the platform to Langflow version 1.13.0 (or higher), which disables automatic login by default and resolves code control flaws.

  1. Create a full backup of the database, secret key, and uploaded files.
  2. If the server previously relied on auto-login, prepare existing accounts for password sign-in as detailed in official guidance.
  3. Upgrade the Python package by executing:
    bash 
    pip install --upgrade "langflow==1.13.0"
  4. For Docker container deployments, migrate to the official image langflowai/langflow:1.13.0 while maintaining persistent volume data. Warning: Avoid completely uninstalling or reinstalling Langflow to regain access, as documentation warns this can permanently remove your configured flows.

Detection

Blue Teams should monitor access logs for unauthorized requests targeting endpoints such as /api/v1/auto_login and /api/v1/validate/code, or anomalous connections directed at MCP service ports without valid authorization headers. Auditing perimeter network traffic for automated scanning tools and framework modules (such as Metasploit’s langflow_auth_bypass_cve_2026_93680.rb) is strongly advised.

Wrapping Up

The critical vulnerabilities uncovered in Langflow highlight the inherent risks of deploying default configurations in AI tools that prioritize zero-friction development over rigorous security controls. The combination of authentication bypasses and code execution capabilities requires organizations to urgently audit their environments and apply patches to version 1.13.0 to mitigate active exploitation exposure.

References