Langflow: Patch to 1.13.0 Now, Every Release From 1.0 Has Critical Flaws

If you run Langflow to build AI agents and workflows, stop and upgrade. IBM says every release from 1.0.0 through 1.12.8 has two critical flaws that let an attacker with no account bypass authentication or run code. The only fix is 1.13.0.

The details

• One is unauthenticated remote code execution through MCP tool enumeration.
• A public Metasploit module already uses CVE-2026-93680, the auth bypass, to connect to a Langflow MCP endpoint without credentials and list its tools.
• LANGFLOW_AUTO_LOGIN is on by default in 1.12.8 and logs everyone in as superuser. 1.13 turns it off.
• IBM also published 29 more Langflow CVEs, including CVE-2026-104339 (9.8, unauthenticated code execution).
• There’s no workaround. None of these are in CISA’s KEV catalog yet.

How to upgrade

Back up the database, secret key and uploads. If you use auto-login, set up a password sign-in first. Then run pip install --upgrade "langflow==1.13.0" or move to the langflowai/langflow:1.13.0 image. Don’t reinstall to get back in, because that can wipe your flows.

And don’t leave it exposed to the internet.

God Bless, and Needs Garlic!

References & Further Reading

• Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers (The Hacker News)