IBM, the CVE numbering authority for Langflow OSS, published a security bulletin on 28 October 2026 (updated 29 October) saying Langflow OSS 1.0.0 through 1.12.8 is affected by vulnerabilities that could allow a remote attacker to bypass authentication controls, execute arbitrary code, expose API credentials, or disclose information through vulnerable dependencies. IBM lists an incomplete remediation of an auto-login security control, agentic code execution via a third-party library, operator-injected API key exposure reachable without intended authorization, and unauthenticated remote code execution exploitable through model context protocol (MCP) tool enumeration.

The Langflow entries are CVE-2026-93680 (improper authentication, 9.8), CVE-2026-110186 (code injection, 9.8), CVE-2026-110193 (a low-privileged authenticated user can make the Agentic Assistant generate or submit component code that runs operating system commands on the server, 8.8) and CVE-2026-110192 (insufficiently protected credentials, 6.5); the bulletin also lists three Hono framework flaws (CVE-2026-84363, CVE-2026-84364, CVE-2026-84365; 5.3 to 6.5, fixed in Hono 4.13.5) among the open-source dependencies included in the product. IBM lists no workarounds or mitigations.

This is a separate fix from IBM's 2 October Langflow bulletin already on Cyberstack (fixed in 1.12.3), so 1.12.x installs up to 1.12.8 are affected. (source: IBM)

Correction (02 Nov 2026): removed The Hacker News as a source; the card now rests on IBM's 28 Oct bulletin and the CVE records carrying CISA's 30 Oct assessment. (source: IBM; CVE records)