Langflow 1.13.0 Patches Critical AI Workflow Flaws

Last updated: November 4, 2026

Langflow security flaws turn an AI workflow builder into a high-value target. If your organization runs the open-source platform, the operational question is straightforward: can you upgrade quickly without losing the secrets and data its workflows depend on?

IBM has released Langflow 1.13.0 to fix four vulnerabilities, two rated critical with a CVSS score of 9.8. According to csoonline.com, affected releases span versions 1.0.0 through 1.12.8, while earlier Langflow vulnerabilities were exploited in the wild to steal AI and developer credentials.

• The patches address an authentication bypass, two code-execution flaws and an API-credential disclosure issue.
• Langflow OSS 1.0.0 through 1.12.8 are affected.
• Version 1.13.0 is available through PyPI and as a Docker image.
• Deployments using automatic login must prepare accounts for password sign-in.
• IBM also recommends upgrading the bundled Hono framework to version 4.13.5.

What Langflow’s latest flaws expose

The most serious finding, CVE-2026-93680, follows an incomplete repair of an earlier auto-login problem. An attacker who exploits it may bypass restrictions and reach features that should require authentication. That makes this more than a patch-management footnote: access control at the application layer may not provide the boundary defenders expect.

CVE-2026-110186 is the other critical issue. It enables unauthenticated remote attackers to run arbitrary code by enumerating Model Context Protocol tools. No authenticated session is required, which removes a meaningful barrier to exploitation.

A third flaw, CVE-2026-110193, also permits server-side code and command execution, but requires an account with at least low-level privileges. Its rating is high rather than critical. The fourth issue, CVE-2026-110192, exposes insufficiently protected API credentials and carries a CVSS score of 6.5.

Together, these findings create several connected risks: unauthorized access, execution on the Langflow host, and theft of credentials that may grant access to other systems. For security teams, the asset inventory matters as much as the CVSS label. An exposed development instance can still contain production secrets or connect to sensitive model and data services.

Upgrade carefully, but don’t delay

Langflow 1.13.0 is the fixed release, but replacing a container is only one part of the job. The database, secret key and uploaded files may need to survive the transition, and automatic-login deployments also require an authentication change. A deployment can therefore remain vulnerable even after images have been pulled if the upgrade is incomplete.

IBM’s sequence is sensible: back up the database, secret key and uploaded files before upgrading; then follow the installation and Docker upgrade guidance to prepare existing accounts for password sign-in. The Hono update to 4.13.5 should be included as part of the same maintenance window rather than treated as an optional dependency cleanup.

Defenders should inventory every Langflow instance before making changes. The relevant questions are not limited to production. Developers may run the platform on laptops or shared workstations, while teams may also maintain staging, testing or customer-specific environments. Each copy can hold different credentials and connections, even if the software version is identical.

Then check whether any instance remains on 1.12.8 or an earlier affected release. Review access logs for unexpected requests, newly created accounts, suspicious command activity and tool-enumeration requests. Rotate exposed API credentials if there is any possibility that a vulnerable instance was reachable before the upgrade. Patching closes the known paths; it does not undo a credential already stolen.

Why this matters for defenders

Langflow sits close to valuable infrastructure. It helps users assemble AI agents, LLM-powered workflows and retrieval-augmented generation systems, often connecting those workflows to credentials and services outside the visual editor. A compromise of the builder may therefore provide a route beyond the application itself.

The practical advantage of upgrading to 1.13.0 is that it centralizes fixes for several different failure modes. The trade-off is operational disruption in environments where state is stored locally and automatic login is configured. Teams should compare a short, controlled upgrade window against leaving critical vulnerabilities in place. For the two unauthenticated or effectively authentication-bypassable paths, that trade-off is not close.

This case also illustrates why vulnerability count alone is an incomplete prioritization method. The credential-disclosure issue has a lower score than the critical flaws, yet its business impact may be substantial if the exposed keys can reach production APIs. Conversely, the privilege requirement attached to CVE-2026-110193 narrows its immediate exposure but does not make it harmless.

A concrete response scenario

Say you operate a staging Langflow instance for an agent team. Suppose the container image is tagged 1.12.8, but a separate deployment uses the latest tag and already runs 1.13.0. Don’t assume the staging copy inherited the upgrade. Inventory its exact version, stop new logins if unauthorized activity is suspected, back up its state and apply the fixed release with the required account and Hono changes.

Afterward, compare API keys and service credentials used by that instance against the organization’s secret inventory. Replace any credential that may have been exposed, then test authenticated and unauthenticated access to confirm that the old paths are closed. Also verify that monitoring covers both the Langflow service and any downstream systems contacted by its workflows.

What to watch next

Bottom line: treat Langflow 1.13.0 as an urgent upgrade for affected deployments, not as a routine dependency update. Include the Hono 4.13.5 change, complete the auto-login adjustment, rotate potentially exposed credentials and confirm that every Langflow instance—not just the production one—runs the fixed release.

Key takeaways

• Identify all Langflow deployments and upgrade affected versions to 1.13.0.
• Back up the database, secret key and uploaded files before the upgrade.
• Prepare automatic-login accounts for password sign-in as IBM directs.
• Upgrade Hono to version 4.13.5 and rotate credentials that may have been exposed.
• Review logs for unauthorized access, tool enumeration and suspicious server-side commands.