Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-0bed561f10Early warningVulnerabilityReported, not confirmed

IBM discloses two critical Langflow flaws allowing unauthenticated code execution

IBM said two critical flaws in Langflow could let a remote attacker without an account bypass authentication or run arbitrary code. Every release from 1.0.0 through 1.12.8 is affected, and version 1.13.0 is the only fix.

Written by a model from the sources below. Verify against them.

Sources2Reported, not confirmed
Kind
Vulnerability
Vendor
Langflow
Product
Langflow
Status
Reported, not confirmed
First seen

What to do

  • Upgrade Langflow to version 1.13.0 or later

  • Restrict network access to Langflow instances until patched

  • Review Langflow logs for unexpected requests or code execution

Timeline

  1. Made public by The Hacker News
  2. First seen by cve.now

Evidence 2

  1. Press
    The Hacker News
    “Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week.”
  2. Social
    Mastodon
    “IBM disclosed critical Langflow OSS flaws affecting versions 1.0.0–1.12.8, including authentication bypass (CVE-2026-93680) and unauthenticated remote code execution (CVE-2026-110186).”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about SZB-0bed561f10

Has Langflow confirmed it?

The Hacker News and Mastodon report it. No statement from Langflow has reached cve.now yet.Source: The Hacker News, Mastodon

What should Langflow users do?

Upgrade Langflow to version 1.13.0 or later. Restrict network access to Langflow instances until patched. Review Langflow logs for unexpected requests or code execution.

Sources