Critical Langflow Flaws (CVE-2026-93680, CVE-2026-110186) Allow Unauthenticated Attackers to Run Code on Servers

Key facts for Langflow unauthenticated RCE

Detection coverage for Langflow unauthenticated RCE

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5058 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Langflow Unauthenticated MCP Composer Tool Enumeration (CVE-2026-93680) — Exploitation

Detects external clients repeatedly reaching Langflow MCP endpoints (/api/v1/mcp*) with successful responses within a short window, the behaviour of the CVE-2026-93680 authentication bypass (MCP composer, auth_type=oauth) and of the public Metasploit module gather/langflow_auth_bypass_cve_2026_93680, which enumerates exposed MCP tools and initiates sessions. Endpoint path is a hunting heuristic derived from the MCP composer description, not a vendor-published signature.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1518, T1212
• Data sources: web:access_combined (reverse proxy / nginx / Apache access logs), CommonSecurityLog (WAF/CEF), webserver logs
• Severity: critical
• Confidence: medium

Splunk SPL

index=web sourcetype=access_combined uri_path="/api/v1/mcp*" status IN (200,202)
| where NOT (cidrmatch("10.0.0.0/8",clientip) OR cidrmatch("172.16.0.0/12",clientip) OR cidrmatch("192.168.0.0/16",clientip))
| bin _time span=10m
| stats count AS requests dc(uri_path) AS distinct_paths values(uri_path) AS paths values(useragent) AS user_agents BY _time clientip host
| where requests>=3
| eval detection="TL-2026-5058 CVE-2026-93680 Langflow unauthenticated MCP composer tool enumeration"
| table _time clientip host requests distinct_paths paths user_agents detection

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has '/api/v1/mcp'
| where not(ipv4_is_private(SourceIP))
| summarize Requests = count(), Urls = make_set(RequestURL, 10), UserAgents = make_set(RequestClientApplication, 10) by SourceIP, DestinationIP, bin(TimeGenerated, 10m)
| where Requests >= 3
| project TimeGenerated, SourceIP, DestinationIP, Requests, Urls, UserAgents

Sigma

title: Langflow Unauthenticated MCP Composer Access From External Client
id: 6f1c2a54-3b7d-4e0a-9c1e-5a8d2f4b7c11
status: experimental
description: Detects successful requests to Langflow MCP endpoints from non-private clients, consistent with CVE-2026-93680 MCP composer authentication bypass and tool enumeration. Path is a hunting heuristic.
references:
    - https://www.ibm.com/support/pages/node/7294467
    - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.initial-access
    - attack.t1190
    - attack.discovery
    - attack.t1518
    - attack.credential-access
    - attack.t1212
    - cve.2026.93680
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains: '/api/v1/mcp'
        sc-status:
            - 200
            - 202
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Legitimate remote MCP clients (IDE agents, partner integrations) using Langflow MCP servers
    - External uptime or vulnerability scanners
level: high

Known false positives:

• Legitimate external MCP clients (IDE agents, partner integrations) connecting to Langflow MCP servers
• Authorized external vulnerability scans or uptime monitors hitting /api/v1/mcp

Tuning notes: Adjust the sourcetype, index and field names (clientip, uri_path, status, useragent) to your proxy log format. If the proxy logs the Authorization header, add a filter to keep only requests with no credentials. Allow-list known MCP client IP ranges and raise or lower the requests threshold (default 3 per 10 minutes). Prioritise hosts running Langflow 1.0.0 through 1.12.8 that have not been upgraded to 1.13.0.

• 🔒 External POST to [indicator] Code and MCP Endpoints (CVE-2026-110186) — Exploitation · unlock with TL Creds
• 🔒 External Access to [indicator] Auto-Login Superuser Endpoint (LANGFLOW_AUTO_LOGIN) — Valid Accounts · unlock with TL Creds
• 🔒 Outbound Connection From Shell or Utility Spawned by [indicator]/Python (Reverse Shell C2) · unlock with TL Creds
• 🔒 Scripted Client Probing [indicator] MCP Endpoints (Metasploit gather/langflow_auth_bypass_cve_2026_93680) · unlock with TL Creds
• 🔒 Python Reverse-Shell or Interpreter One-Liner Launched by [indicator] Process · unlock with TL Creds
• 🔒 Credential and Environment Harvesting Commands Spawned by [indicator] Process · unlock with TL Creds
• 🔒 Shell or Interpreter Spawned by [indicator] Server Process (CVE-2026-110186 / CVE-2026-110193) — Post-Exploitation · unlock with TL Creds
• 🔒 [indicator] Secret and Credential File Access by Shell Tools (CVE-2026-110192) — Credential Access · unlock with TL Creds

Indicators of compromise for Langflow unauthenticated RCE

As of 2026-11-02, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5058.

How Langflow unauthenticated RCE works

IBM Security Bulletin (published 2026-10-28, updated 2026-10-29) and the corresponding CVE records (published 2026-10-29, updated 2026-10-30) disclose four vulnerabilities in Langflow OSS 1.0.0 through 1.12.8, an open-source visual framework for building AI agents and workflows.

CVE-2026-93680 (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287 Improper Authentication) lets a remote, unauthenticated attacker bypass security restrictions. Per Rapid7 and The Hacker News reporting, the issue sits in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (the default) and projects are configured with auth_type=oauth; an unauthenticated caller can enumerate the MCP tools a server exposes and initiate sessions. A public Metasploit auxiliary module (gather/langflow_auth_bypass_cve_2026_93680, author Richard Howe, PR #21942, covering 1.5.0 through 1.11.4) exercises this bypass and is limited to reconnaissance (tool listing). The hunt notes it was tested on Langflow 1.8.4 with automatic login enabled.

CVE-2026-110186 (CVSS 9.8, same vector, CWE-94 Improper Control of Generation of Code) allows a remote, unauthenticated attacker to execute arbitrary code on the server due to improper control of code generation. The Hacker News ties it to insufficient code-generation controls reachable via MCP tooling; no public exploit for this CVE is cited in the sources.

CVE-2026-110193 (CVSS 8.8, AV:N/AC:L/PR:L, CWE-94) lets a low-privileged authenticated account cause the Agentic Assistant to generate or submit component code using unblocked patterns, resulting in arbitrary OS command execution on the server. CVE-2026-110192 (CVSS 6.5, CWE-522 Insufficiently Protected Credentials) lets an authenticated attacker obtain sensitive information.

The LANGFLOW_AUTO_LOGIN setting, enabled by default in 1.12.8 per The Hacker News, bypasses authentication, logs users in as superuser, and is intended for development environments only. Exploitation in the wild is not stated in any source and neither flaw was in CISA KEV as of the 2026-10-30 update. Langflow has a history of repeated critical code-execution and authentication flaws in 2026 (earlier IBM bulletins of 2026-07-31 and 2026-10-19 and Rapid7's 2026-10-23 wrap-up of further Metasploit modules), so internet-exposed instances should be treated as high-risk. Fix: upgrade to Langflow OSS 1.13.0 (pip install --upgrade "langflow==1.13.0" or Docker langflowai/langflow:1.13.0). IBM documents no mitigations for these four CVEs.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1059.006 Python; T1203 Exploitation for Client Execution

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Defense Evasion

T1078 Valid Accounts

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Discovery

T1518 Software Discovery

Remediation for Langflow unauthenticated RCE

Patches

• Langflow OSS 1.13.0 (released 2026-10-22), per IBM Security Bulletin node 7294467

Immediate actions

• Upgrade Langflow OSS to 1.13.0 or later (pip install --upgrade "langflow==1.13.0" or Docker image langflowai/langflow:1.13.0)
• Remove Langflow instances from direct internet exposure until patched
• Disable LANGFLOW_AUTO_LOGIN outside development environments
• Review MCP composer and OAuth-protected project configuration for unauthenticated access

Workarounds

• IBM documents no mitigations for these CVEs; earlier Langflow bulletins cite LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true as additional hardening, which is not confirmed to cover these CVEs

Longer-term hardening

• Restrict Langflow access to authenticated, network-segmented users
• Run Langflow with least-privilege OS accounts and containers
• Rotate credentials and API keys stored in Langflow flows and variables (CVE-2026-110192 exposure)
• Monitor for unauthenticated requests to MCP endpoints and unexpected child processes of the Langflow server

Affected and fixed versions

• IBM / Langflow — Langflow OSS
  Vulnerable versions: 1.0.0 through 1.12.8
  Fixed in: 1.13.0

Timeline of Langflow unauthenticated RCE

• 2026-09-18 CVE-2026-93680 identifier reserved
• 2026-10-13 CVE-2026-110186, CVE-2026-110193 and CVE-2026-110192 identifiers reserved
• 2026-10-22 locked-ioc-7 1.13.0 released, fixing the four vulnerabilities
• 2026-10-23 locked-ioc-4 wrap-up announces auxiliary module locked-ioc-1 (PR #21942) for the authentication bypass
• 2026-10-28 IBM publishes security bulletin for locked-ioc-7 OSS 1.0.0 through 1.12.8 (updated 2026-10-29)
• 2026-10-29 CVE-2026-93680, CVE-2026-110186, CVE-2026-110193 and CVE-2026-110192 published in the CVE program
• 2026-10-30 CVE records updated; neither critical flaw listed in CISA KEV as of this update
• 2026-11-02 The Hacker News reports the two unauthenticated CVSS 9.8 flaws

Sources cited for Langflow unauthenticated RCE

• CVE-2026-93680 CVE record raw.githubusercontent.com · Advisory · 2026-10-29
• CVE-2026-110186 CVE record raw.githubusercontent.com · Advisory · 2026-10-29
• CVE-2026-110193 CVE record raw.githubusercontent.com · Advisory · 2026-10-29
• CVE-2026-110192 CVE record raw.githubusercontent.com · Advisory · 2026-10-29
• IBM Security Bulletin: Langflow OSS affected by multiple vulnerabilities (CVE-2026-93680, CVE-2026-110186, CVE-2026-110193, CVE-2026-110192) ibm.com · Vendor report · 2026-10-28
• Metasploit Wrap-Up: Langflow, MongoDB and more (Rapid7) Rapid7 · Research · 2026-10-23
• IBM Security Bulletin: Langflow affected by vulnerabilities in Model Context Protocol features ibm.com · Vendor report · 2026-07-31
• IBM Security Bulletin: Langflow OSS affected by multiple vulnerabilities (1.0.0-1.12.4) ibm.com · Vendor report · 2026-10-19
• Langflow releases (v1.13.0) GitHub · Code repository · 2026-10-22
• Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers The Hacker News · News · 2026-11-02

More in vulnerability

• FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)
• PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)
• CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware
• NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kit
• iPhone BootROM Flaws (checkm8 CVE-2019-8900, usbliter8) Could Be Used to Undermine Cryptocurrency Wallet Security