Patch Forecast
Amber warning
Patch this week.

CVE-2026-93680

Langflow: authentication bypass

Risk score
64/100
CVSS
9.8 v3.1
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM Langflow OSS versions 1.0.0 through 1.12.8 have a vulnerability due to improper authentication, allowing a remote attacker to bypass security restrictions.
Affected
{'products': ['IBM Langflow OSS'], 'packages': [], 'versions': ['1.0.0', '1.1.0', '1.2.0', '1.3.0', '1.4.0', '1.5.0', '1.6.0', '1.7.0', '1.8.0', '1.9.0', '1.10.0', '1.11.0', '1.12.0', '1.12.1', '1.12.2', '1.12.3', '1.12.4', '1.12.5', '1.12.6', '1.12.7', '1.12.8']}
Fix
Check the linked advisory for a fix, as none is provided.
Exploitation
No known exploitation

Not confirmed. 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0 isn't in the advisory. Check the vendor's advisory before acting on this.

Story map

Story map: LangflowTHE FLAWSTHE FIXCVE-2026-93680Authentication bypassCVSS 9.8CVE-2026-93674Code injection can lead toremote code executionCVSS 9.8 · EPSS 15%CVE-2026-10561Langflow:PythonREPLComponentexecutes unsandboxed Python…CVSS 10.0 · EPSS 1%CVE-2026-55255Langflow Authorization BypassThrough User-Controlled KeyVulnerabilityCVSS 8.4 · exploitedUpgrade Langflow1.9.1or later on your release lineWho is exposedLangflowRED · ACT TODAYLangflowIBM Langflow OSS 1.0.0 through1.12.2 could allow a remoteattacker to execute arbitrarycode due to improperneutralization of specialelements used in an OS command.Where it standsExploited in the wildOn CISA's exploited list since 7 JulUS federal deadline 10 JulHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.7 Jul · CISAAdded to the Known Exploited Vulnerabilities list10 Jul · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessAuthentication bypass (CWE-287)279 other warnings in 30 days →Same productEarlier Langflow warnings57 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Langflow: Red, act today. IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

The flaws

  • CVE-2026-93680: Authentication bypass (CVSS 9.8)
  • CVE-2026-93674: Code injection can lead to remote code execution (CVSS 9.8 · EPSS 15%)
  • CVE-2026-10561: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation (CVSS 10.0 · EPSS 1%)
  • CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability (CVSS 8.4 · exploited)

The fix

Upgrade Langflow: 1.9.1 or later on your release line

Who is exposed: Langflow

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 7 Jul
  • US federal deadline 10 Jul

How it unfolded

  1. 7 Jul, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 10 Jul, Deadline (official): US federal agencies must have patched

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

Last activity 29 Oct 2026. Patch Forecast updates every hour.