Langflow authentication bypass, unauthenticated access (CVE-2026-93680) [PoC]

Weaponized - Metasploit module available - CVE-2026-93680 is a critical authentication bypass in IBM Langflow OSS 1.0.0 through 1.12.8 that lets a remote attacker with no credentials reach protected flows, components, and API endpoints. Upgrade to Langflow 1.12.9 or later; there is no configuration workaround that fully closes the gap.

Overview

Langflow is an open-source visual builder for AI agents and LLM pipelines. It exposes a REST API and a web UI, and it stores flow definitions, model credentials, and tool connections behind an authentication layer. CVE-2026-93680 is a defect in that authentication layer: requests that should be rejected are instead treated as trusted.

The CVSS vector is as bad as it gets for a network service. Attack Vector is NETWORK, Attack Complexity is LOW, Privileges Required is NONE, and User Interaction is NONE. That means anyone who can reach the Langflow port can attempt the bypass, with no account, no token, and no victim clicking anything.

Impact

A successful bypass hands the attacker the same access a logged-in user would have. In practice that is severe for this product, because Langflow deployments hold the keys to everything downstream:

• Flow definitions and prompts become readable, editable, and executable. Attackers can insert steps into an existing flow and have it run on the next legitimate invocation.
• Stored credentials for OpenAI, Anthropic, cloud providers, vector databases, and internal APIs are exposed.
• Connected tools such as code execution nodes, database connectors, and HTTP callers can be driven by the attacker, turning Langflow into a pivot into internal networks.
• API keys issued by Langflow itself can be created or abused, extending persistence beyond the initial visit.

Because Langflow is often deployed internally by AI engineering teams without the network controls a customer-facing service would get, an exposed instance is a realistic path to cloud credential theft and lateral movement.

Remediation and mitigation

1. Upgrade to Langflow 1.12.9 or later. IBM shipped the fix; check the vendor advisory for the exact build and confirm your container image or pip install is on the patched version rather than a cached layer.
2. Rotate secrets. Assume any credential stored in Langflow flows was readable. Rotate provider API keys, database passwords, and any Langflow-issued tokens.
3. Remove internet exposure. Langflow should not be reachable from the public internet. Put it behind a VPN or an authenticating reverse proxy, and restrict egress from the host so a compromised instance cannot reach internal services freely.
4. Audit for prior abuse. Review access logs for unauthenticated requests to protected endpoints, unusual flow edits, and outbound connections to unfamiliar hosts. Incident responders and breach documentation are available via breach reports, with ongoing coverage at security news.

Security Insight

Langflow follows a pattern now common across AI orchestration tooling: authentication is bolted on after the API surface is designed, so a single missed dependency leaves the whole control plane open. The comparison worth drawing is to early Jenkins and JupyterHub deployments, where the same “internal tool, trusted network” assumption turned a convenience feature into an entry point for cloud credential theft. For teams running LLM infrastructure, the lesson is that these platforms now hold credentials as sensitive as any CI/CD system and deserve the same patching cadence and network segmentation.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs