IBM patched critical vulnerabilities in Langflow, an open-source framework for building AI agents, LLM-powered workflows, and retrieval-augmented generation (RAG) systems. The flaws could allow attackers to bypass authentication, leak API credentials, and execute arbitrary code.
Langflow, now owned by IBM, is popular in enterprise environments because it offers a visual experience that doesn’t require coding knowledge to create AI workflows and agents. Vulnerabilities in the framework have been exploited in the wild to steal AI and developer credentials before, most recently in August.
This latest round of security patches fix four vulnerabilities, two of which are rated critical with 9.8 CVSS score. One flaw, tracked as CVE-2026-93680, stems from an incomplete remediation of a previous auto-login security issue. Exploiting it could allow attackers to bypass security restrictions and gain access to features that would normally require authentication.
Another flaw, CVE-2026-110186, allows unauthenticated remote attackers to execute arbitrary code through Model Context Protocol (MCP) tool enumeration. A third vulnerability, CVE-2026-110193, which is rated as high severity, also allows for code and command execution on the server due to an issue in a third-party library used by the Agentic Assistant. However, exploiting this flaw requires authentication with at least a low-privileged account.
The fourth vulnerability, CVE-2026-110192, is an information disclosure issue due to insufficiently protected API credentials. It is rated as 6.5 on the CVSS scale.
The flaws affect Langflow OSS versions 1.0.0 to 1.12.8 and were fixed in the newly released 1.13.0 version, which is available both from the PyPI repository and as a Docker image.
“Before upgrading, back up the database, secret key, and uploaded files,” IBM said in its advisory. “If the deployment uses automatic login, prepare the existing account for password sign-in as described in the installation and Docker upgrade instruction.”
The company also released patches for three medium-severity flaws in Hono, an API and web application development framework used inside Langflow for request routing and backend web server tasks. The company advises users to upgrade Hono to version 4.13.5.