# CVE-2026-93680

Published articles for CVE-2026-93680.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers

DevFeed: [Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers](<https://devfeed.tech/articles/critical-langflow-flaws-could-let-unauthenticated-attackers-run-code-on-servers-112962.md>)

Original publisher: [Read original article](<https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html>)

Author: The Hacker News

Published: 2026-11-02T11:50:00Z

Content type: news

Language: en

Sources: [Cyber Newsroom](<https://devfeed.tech/sources/cyber-newsroom.md>)

Topics: [Security research](<https://devfeed.tech/topics/security-research.md>), [code security](<https://devfeed.tech/topics/code-security.md>), [Local AI](<https://devfeed.tech/topics/local-ai.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [api-security](<https://devfeed.tech/tags/api-security.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [automatic](<https://devfeed.tech/tags/automatic.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [code-execution](<https://devfeed.tech/tags/code-execution.md>), [control](<https://devfeed.tech/tags/control.md>), [critical](<https://devfeed.tech/tags/critical.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-93680](<https://devfeed.tech/tags/cve-2026-93680.md>), [database](<https://devfeed.tech/tags/database.md>), [docker](<https://devfeed.tech/tags/docker.md>), [enumeration](<https://devfeed.tech/tags/enumeration.md>), [ibm](<https://devfeed.tech/tags/ibm.md>), [langflow](<https://devfeed.tech/tags/langflow.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [remote](<https://devfeed.tech/tags/remote.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

IBM reports that Langflow releases 1.0.0 through 1.12.8 contain two critical flaws that may allow unauthenticated authentication bypass or remote code execution; version 1.13.0 is the stated fix, and the excerpt says neither flaw was in CISA's Known Exploited Vulnerabilities catalog as of October 30. A Metasploit module for the authentication bypass can connect to the MCP endpoint and enumerate tools, but does not run server commands; its author lists a narrower affected range than IBM. Langflow 1.12.8 enables automatic login by default, while 1.13.0 disables it by default. To upgrade, back up the database, secret key, and uploaded files; prepare any automatic-login account for password sign-in; then upgrade the Python package or Docker image to 1.13.0 while preserving persistent data. Use the linked recovery guidance if sign-in fails; the excerpt warns that deleting or reinstalling Langflow can permanently remove flows. IBM gives no workaround for servers that cannot upgrade.

### Source excerpt

Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and w ... Read more Published Date: Nov 02, 2026 (13 hours, 59 minutes ago) Vulnerabilities has been mentioned in this article.