What happened
IBM published a security bulletin on October 28, 2026, covering Langflow OSS versions 1.0.0 through 1.12.8. Langflow is used to assemble AI and agent workflows, so the notice concerns deployments where a workflow builder may have access to model providers, application credentials, tools, and services. IBM says the affected versions contain multiple vulnerabilities that could permit authentication bypass, arbitrary code execution, API credential exposure, or disclosure through vulnerable dependencies.
Two listed Langflow issues carry IBM CVSS base scores of 9.8. CVE-2026-93680 is an improper-authentication issue that could allow a remote attacker to bypass security restrictions. CVE-2026-110186 is an improper-control-of-code-generation issue that IBM describes as arbitrary code execution without authentication; the bulletin says it is exploitable through Model Context Protocol tool enumeration. Both have the same CVSS 3.1 vector: network reachable, low attack complexity, no privileges or user interaction required, with high impact on confidentiality, integrity, and availability.
The bulletin also lists CVE-2026-110193, rated 8.8. In that case, a remote attacker with a low-privileged authenticated account could cause the Agentic Assistant to generate or submit component code using unblocked patterns, leading to arbitrary operating-system command execution on the server. CVE-2026-110192, rated 6.5, concerns insufficient protection of credentials and may allow an authenticated attacker to obtain sensitive information. IBM additionally identifies known vulnerabilities in bundled open-source dependencies, including several Hono issues.
IBM's remediation is an upgrade to Langflow OSS 1.13.0; the bulletin does not list a workaround. Python-package users are directed to install langflow==1.13.0 with pip, while Docker users should move to langflowai/langflow:1.13.0, pull the image, and restart while retaining persistent data. Before upgrading, IBM says to back up the database, secret key, and uploaded files. Deployments using automatic login also need to prepare an existing account for password sign-in. The complete advisory is available from IBM's security bulletin.
What the archive adds
We have not covered this before; it opens a new thread.
Trend signal
This incident supports the concern behind Agent security moves to runtime boundaries. A workflow system that can enumerate MCP tools and generate or execute components needs enforceable authorization and execution boundaries. The bulletin establishes the vulnerabilities and patch, not whether any particular deployment architecture adequately supplies those boundaries.
Why now
The timing is operational rather than speculative: IBM identifies all Langflow OSS releases from 1.0.0 through 1.12.8 as affected and names 1.13.0 as the remediation. Teams that run a self-hosted deployment need to account for upgrade preparation, including backups and, where automatic login is enabled, a transition path to password sign-in.
Why it matters
Agent builders often concentrate on prompts, tool descriptions, and model behavior. This bulletin is a reminder that the workflow runtime itself is part of the security boundary. In an affected Langflow deployment, the documented risks extend beyond a broken interface: the listed issues include authentication bypass, server-side arbitrary code execution, and credential exposure. The MCP-related RCE description matters especially because tool discovery is a normal capability in agent systems, yet the bulletin says it can be part of an unauthenticated attack path here.
For a team running Langflow, the immediate engineering work is straightforward but consequential: identify the deployed version, preserve the state IBM specifies, upgrade to 1.13.0, and validate the deployment's authentication behavior afterwards. Treating the update as an application-runtime change rather than a routine package refresh is appropriate when secrets, uploaded files, and tool-connected workflows are involved.
What happens next
- Affected self-hosted operators will move to Langflow OSS 1.13.0 or later. (3 months, 75%). Watch for: updated deployment images and version inventories.
- Teams will review MCP tool exposure and runtime authorization after applying the patch. (6 months, 60%). Watch for: explicit tool-access controls in deployment runbooks.
Limits and uncertainty
The bulletin identifies affected versions, vulnerability classes, severity scores, and IBM's recommended remediation. It does not establish how widely vulnerable Langflow OSS is deployed, whether these flaws have been exploited in the wild, or whether every deployment configuration is equally exposed. It also does not provide exploit code, an attack timeline, or evidence that upgrading alone resolves security issues in connected tools and credentials. The notice lists dependency vulnerabilities, but its practical impact for any individual environment depends on the deployed configuration and reachable attack surface.
Skill to build now
Create a short runtime-security inventory for every agent workflow deployment this week: record the deployed Langflow version, authentication mode, persistent-data location, secret-key handling, uploaded-file storage, and the tools the deployment can expose. For Langflow installations in the affected range, use that inventory to make the backup and upgrade plan concrete, then verify password sign-in if automatic login had been enabled. This is a small operational exercise, but it turns a generic patch notice into an auditable change.
Reader takeaway
If you self-host Langflow OSS 1.0.0 through 1.12.8, upgrade to 1.13.0. IBM lists two network-reachable CVSS 9.8 issues, including unauthenticated RCE associated with MCP tool enumeration, and provides no alternative mitigation in the bulletin.
Open question
How will Langflow operators verify that tool enumeration and component-code execution remain appropriately authorized after the upgrade?