# Critical Langflow Flaws (CVE-2026-93680, CVE-2026-110186) Allow Unauthenticated Attackers to Run Code on Servers

> Four vulnerabilities in IBM-listed Langflow OSS 1.0.0 through 1.12.8 include two unauthenticated CVSS 9.8 flaws: an authentication bypass (CVE-2026-93680) and arbitrary code execution through improper control of code generation (CVE-2026-110186). A Metasploit auxiliary module exists for CVE-2026-93680. Fixed in Langflow 1.13.0 (released 2026-10-22).

- **Published:** 2026-11-02T14:01:47Z
- **Last reviewed:** 2026-11-02T14:01:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5058
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5058.png
- **ID:** TL-2026-5058
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-93680, CVE-2026-110186, CVE-2026-110193, CVE-2026-110192

## Description

IBM Security Bulletin (published 2026-10-28, updated 2026-10-29) and the corresponding CVE records (published 2026-10-29, updated 2026-10-30) disclose four vulnerabilities in Langflow OSS 1.0.0 through 1.12.8, an open-source visual framework for building AI agents and workflows.

CVE-2026-93680 (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287 Improper Authentication) lets a remote, unauthenticated attacker bypass security restrictions. Per Rapid7 and The Hacker News reporting, the issue sits in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (the default) and projects are configured with auth_type=oauth; an unauthenticated caller can enumerate the MCP tools a server exposes and initiate sessions. A public Metasploit auxiliary module (gather/langflow_auth_bypass_cve_2026_93680, author Richard Howe, PR #21942, covering 1.5.0 through 1.11.4) exercises this bypass and is limited to reconnaissance (tool listing). The hunt notes it was tested on Langflow 1.8.4 with automatic login enabled.

CVE-2026-110186 (CVSS 9.8, same vector, CWE-94 Improper Control of Generation of Code) allows a remote, unauthenticated attacker to execute arbitrary code on the server due to improper control of code generation. The Hacker News ties it to insufficient code-generation controls reachable via MCP tooling; no public exploit for this CVE is cited in the sources.

CVE-2026-110193 (CVSS 8.8, AV:N/AC:L/PR:L, CWE-94) lets a low-privileged authenticated account cause the Agentic Assistant to generate or submit component code using unblocked patterns, resulting in arbitrary OS command execution on the server. CVE-2026-110192 (CVSS 6.5, CWE-522 Insufficiently Protected Credentials) lets an authenticated attacker obtain sensitive information.

The LANGFLOW_AUTO_LOGIN setting, enabled by default in 1.12.8 per The Hacker News, bypasses authentication, logs users in as superuser, and is intended for development environments only. Exploitation in the wild is not stated in any source and neither flaw was in CISA KEV as of the 2026-10-30 update. Langflow has a history of repeated critical code-execution and authentication flaws in 2026 (earlier IBM bulletins of 2026-07-31 and 2026-10-19 and Rapid7's 2026-10-23 wrap-up of further Metasploit modules), so internet-exposed instances should be treated as high-risk. Fix: upgrade to Langflow OSS 1.13.0 (pip install --upgrade "langflow==1.13.0" or Docker langflowai/langflow:1.13.0). IBM documents no mitigations for these four CVEs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.006 Python
- T1203 Exploitation for Client Execution
- T1552 Unsecured Credentials
- T1212 Exploitation for Credential Access
- T1518 Software Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Langflow Unauthenticated MCP Composer Tool Enumeration (CVE-2026-93680) — Exploitation** (`TL-2026-5058-SPL-001`)

Detects external clients repeatedly reaching Langflow MCP endpoints (/api/v1/mcp*) with successful responses within a short window, the behaviour of the CVE-2026-93680 authentication bypass (MCP composer, auth_type=oauth) and of the public Metasploit module gather/langflow_auth_bypass_cve_2026_93680, which enumerates exposed MCP tools and initiates sessions. Endpoint path is a hunting heuristic derived from the MCP composer description, not a vendor-published signature.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1518, T1212
- **Data sources:** web:access_combined (reverse proxy / nginx / Apache access logs), CommonSecurityLog (WAF/CEF), webserver logs
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

```spl
index=web sourcetype=access_combined uri_path="/api/v1/mcp*" status IN (200,202)
| where NOT (cidrmatch("10.0.0.0/8",clientip) OR cidrmatch("172.16.0.0/12",clientip) OR cidrmatch("192.168.0.0/16",clientip))
| bin _time span=10m
| stats count AS requests dc(uri_path) AS distinct_paths values(uri_path) AS paths values(useragent) AS user_agents BY _time clientip host
| where requests>=3
| eval detection="TL-2026-5058 CVE-2026-93680 Langflow unauthenticated MCP composer tool enumeration"
| table _time clientip host requests distinct_paths paths user_agents detection
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has '/api/v1/mcp'
| where not(ipv4_is_private(SourceIP))
| summarize Requests = count(), Urls = make_set(RequestURL, 10), UserAgents = make_set(RequestClientApplication, 10) by SourceIP, DestinationIP, bin(TimeGenerated, 10m)
| where Requests >= 3
| project TimeGenerated, SourceIP, DestinationIP, Requests, Urls, UserAgents
```

### Sigma

```yaml
title: Langflow Unauthenticated MCP Composer Access From External Client
id: 6f1c2a54-3b7d-4e0a-9c1e-5a8d2f4b7c11
status: experimental
description: Detects successful requests to Langflow MCP endpoints from non-private clients, consistent with CVE-2026-93680 MCP composer authentication bypass and tool enumeration. Path is a hunting heuristic.
references:
    - https://www.ibm.com/support/pages/node/7294467
    - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.initial-access
    - attack.t1190
    - attack.discovery
    - attack.t1518
    - attack.credential-access
    - attack.t1212
    - cve.2026.93680
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains: '/api/v1/mcp'
        sc-status:
            - 200
            - 202
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Legitimate remote MCP clients (IDE agents, partner integrations) using Langflow MCP servers
    - External uptime or vulnerability scanners
level: high
```

**Known false positives:**

- Legitimate external MCP clients (IDE agents, partner integrations) connecting to Langflow MCP servers
- Authorized external vulnerability scans or uptime monitors hitting /api/v1/mcp

**Tuning notes:** Adjust the sourcetype, index and field names (clientip, uri_path, status, useragent) to your proxy log format. If the proxy logs the Authorization header, add a filter to keep only requests with no credentials. Allow-list known MCP client IP ranges and raise or lower the requests threshold (default 3 per 10 minutes). Prioritise hosts running Langflow 1.0.0 through 1.12.8 that have not been upgraded to 1.13.0.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- External POST to [indicator] Code and MCP Endpoints (CVE-2026-110186) — Exploitation (locked: unlock with TL Creds)
- External Access to [indicator] Auto-Login Superuser Endpoint (LANGFLOW_AUTO_LOGIN) — Valid Accounts (locked: unlock with TL Creds)
- Outbound Connection From Shell or Utility Spawned by [indicator]/Python (Reverse Shell C2) (locked: unlock with TL Creds)
- Scripted Client Probing [indicator] MCP Endpoints (Metasploit gather/langflow_auth_bypass_cve_2026_93680) (locked: unlock with TL Creds)
- Python Reverse-Shell or Interpreter One-Liner Launched by [indicator] Process (locked: unlock with TL Creds)
- Credential and Environment Harvesting Commands Spawned by [indicator] Process (locked: unlock with TL Creds)
- Shell or Interpreter Spawned by [indicator] Server Process (CVE-2026-110186 / CVE-2026-110193) — Post-Exploitation (locked: unlock with TL Creds)
- [indicator] Secret and Credential File Access by Shell Tools (CVE-2026-110192) — Credential Access (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers](https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html)
- [IBM Security Bulletin: Langflow OSS affected by multiple vulnerabilities (CVE-2026-93680, CVE-2026-110186, CVE-2026-110193, CVE-2026-110192)](https://www.ibm.com/support/pages/node/7294467)
- [CVE-2026-93680 CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93680.json)
- [CVE-2026-110186 CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110186.json)
- [CVE-2026-110193 CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110193.json)
- [CVE-2026-110192 CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110192.json)
- [Metasploit Wrap-Up: Langflow, MongoDB and more (Rapid7)](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more)
- [Langflow releases (v1.13.0)](https://github.com/langflow-ai/langflow/releases)
- [IBM Security Bulletin: Langflow affected by vulnerabilities in Model Context Protocol features](https://www.ibm.com/support/pages/security-bulletin-langflow-affected-security-vulnerabilities-model-context-protocol-features)
- [IBM Security Bulletin: Langflow OSS affected by multiple vulnerabilities (1.0.0-1.12.4)](https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-1)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5058