Two critical vulnerabilities in Langflow, an open-source tool for building AI agents and workflows, have been identified by IBM. These flaws allow remote attackers to bypass authentication or execute arbitrary code without an account. Affected versions include all releases from 1.0.0 through 1.12.8, with the only solution being an upgrade to version 1.13.0.

Despite their severity, these vulnerabilities are not yet listed in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of its last update on October 30. However, IBM's security bulletin, initially published on October 28 and updated the following day, details four vulnerabilities in total. One of these, CVE-2026-93680, involves an authentication bypass that can connect to a Langflow server's Model Context Protocol endpoint without credentials. This flaw affects versions 1.5.0 through 1.11.4, according to the Metasploit Framework, although IBM reports a broader range.

A significant issue arises when Langflow's automatic login feature is enabled, logging users in as superusers by default. This setting, LANGFLOW_AUTO_LOGIN, is enabled in version 1.12.8 and bypasses authentication, making it suitable only for development environments. IBM has not clarified whether servers with automatic login disabled are secure.

Langflow version 1.13.0, released on October 22, addresses these issues by turning off automatic login by default. IBM has released CVE records for 29 additional Langflow vulnerabilities, with versions 1.12.4 and 1.12.5 containing fixes for some. Notably, none of these records, including the four critical ones, indicate that version 1.13.0 is affected. Administrators are urged to upgrade to Langflow 1.13.0 immediately, as no workaround is available for systems unable to update.