Report: Two Unauthenticated 9.8 Langflow Flaws Hit Every Release From 1.0.0 to 1.12.8, and the Only Fix Is 1.13.0

Verdict: if you self-host Langflow 1.12.8 or earlier, upgrade to 1.13.0 now. IBM offers no workaround for servers that stay on an older release, automatic login is on by default in 1.12.8 (per The Hacker News), and attack tooling for one of the two 9.8 flaws is already public. Langflow is not in our directory and we have not run it. IBM's bulletin, published 28 October, confirms the affected range, the 1.13.0 fix and that there is no workaround.

What happened

The Hacker News published "Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers" on 2 November 2026. It lists four flaws in Langflow, which builds AI agents and workflows:

• Every release is affected. "Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0." THN dates 1.13.0 to 22 October. IBM's bulletin gives the same range and fix.
• The default makes it worse. LANGFLOW_AUTO_LOGIN "is enabled by default in Langflow 1.12.8". With it on, THN says, Langflow logs users in as superusers without asking them to sign in. "Langflow 1.13 turns automatic login off by default."
• No workaround. "IBM offers no workaround for servers that cannot upgrade yet." IBM's bulletin lists none.
• Tooling exists. "A module in the public Metasploit Framework already cites CVE-2026-93680, the authentication bypass." THN notes the module lists 1.5.0 to 1.11.4 as affected, a narrower range than IBM's, and that it demonstrates the bypass, not code execution.
• Not yet on KEV. Neither 9.8 flaw is in CISA's Known Exploited Vulnerabilities catalog as of its 30 October update, though THN notes six other Langflow flaws already are.

Why it matters

Langflow can offer its flows as MCP tools, and IBM describes one of the flaws as "unauthenticated remote code execution exploitable through model context protocol tool enumeration" without saying which CVE that is. Both 9.8 flaws need no sign-in at all, and on 1.12.8 automatic login removes the sign-in step for everyone else too.

Our read: a server that anyone can reach and that runs 1.12.8 or earlier with automatic login on should be treated as open to anyone who finds it. Expect the keys and data it holds to be at risk until it is upgraded. A public Metasploit module lowers the bar for the bypass, and Langflow's KEV history (six earlier flaws listed) says attackers already watch this product.

What changes for you

• Inventory. Find every self-hosted Langflow server and check its version. Anything from 1.0.0 to 1.12.8 is affected, per IBM's bulletin.
• Upgrade carefully. THN gives upgrade steps, including backing up the database and preparing password sign-in before upgrading, because 1.13 turns automatic login off. Read them first so you do not lock yourself out.
• Isolate what you cannot upgrade today. With no workaround from IBM, take the server off the public internet until it runs 1.13.0.
• Rotate after. If an exposed server ran an affected release with automatic login on, treat the credentials it stored as possibly read.

FAQ

Which Langflow versions are affected? Every release from 1.0.0 through 1.12.8, per IBM's bulletin. The Metasploit module lists a narrower 1.5.0 to 1.11.4, but IBM's range is the one to act on.

Is there a workaround if I cannot upgrade? No. IBM's bulletin lists none, so the only fix is 1.13.0. Until then, keep the server off the public internet.

Are these flaws being exploited? Neither 9.8 flaw was on CISA's KEV catalog as of 30 October, but a public Metasploit module already cites the authentication bypass.

Will upgrading change how I sign in? Yes. Langflow 1.13 turns automatic login off by default, so set up password sign-in before you upgrade.