al-ice.ai

The Login Was Automatic and the Attacker Needed None: Langflow CVE-2026-93680 Turns One GET Into Superuser, Then RCE Through MCP

AI Vulnerabilities & CVEs by al-ice.ai Editorial

The most dangerous authentication bypass is the one the administrator never configured — because the software configured it for them. CVE-2026-93680, published 29 October 2026 and scored 9.8 Critical, affects Langflow OSS 1.0.0 through 1.12.8: every one of those releases ships with automatic login enabled by default, and a single unauthenticated GET to /api/v1/auto_login returns a full superuser session. From there the same unauthenticated caller reaches the MCP endpoint, enumerates flow-authoring and execution tools, and lands at unauthenticated remote code execution via CVE-2026-110186, also 9.8. The only fix is 1.13.0, which turns automatic login off — and there is no workaround. Disclosure comes from Ostorlab (30 October) with the details confirmed in IBM’s security bulletin of 28 October and both NVD records.

One request, full privileges

The kill chain has no first stage worth describing, which is the point. Ostorlab’s writeup is explicit: on any affected instance where the operator did not set LANGFLOW_AUTO_LOGIN=false and create a real superuser — the default in every release from 1.0.0 to 1.12.8 — the auto_login endpoint simply hands the requester a superuser session. No credentials, no brute force, no phishing. IBM’s bulletin frames it as an incomplete remediation of an auto-login security control, which is vendor language for a fix that did not hold: the platform already had a missing-authentication catastrophe in CVE-2025-3248, and the control meant to close that class of hole was itself left open by default. Our July briefing on Langflow entering the KEV catalog traced how that predecessor flaw drew ransomware-campaign exploitation; the lesson operators were supposed to take — treat every Langflow auth control as suspect until verified — now applies to the replacement control too.

From session to shell through the agent surface

What elevates this beyond a textbook auth bypass is where the superuser session leads: straight into the agent execution surface. Per the IBM bulletin, the unauthenticated path runs through MCP tool enumeration to arbitrary code execution (CVE-2026-110186, CWE-94 code injection, network-accessible, no privileges, no user interaction). A second flaw, CVE-2026-110193 (8.8), lets even a low-privileged authenticated account reach operating-system command execution by getting the Agentic Assistant to generate or submit component code through unblocked patterns — agentic code execution via a third-party library, in IBM’s words. A third, CVE-2026-110192, exposes operator-injected API keys to authenticated accounts. Three different trust levels, three different doors, one building: the pattern across this year’s Langflow bulletins — our October briefing on the fourteen-CVE bulletin, the 25-flaw 1.12.3 batch, and the MCP stdio RCE sink — is that the flow-execution engine keeps being reachable from whatever identity layer just failed. Fix the login, and the next bulletin finds the code-execution sink; fix the sink, and the login fails open again.

Upgrade now, and mind the lockout

The remediation facts are unusually blunt. 1.13.0, released 22 October 2026, is the only fixed version; IBM offers no workaround and directs operators to back up the database, secret key, and uploaded files first. There is a trap in the upgrade itself: deployments relying on automatic login must prepare a password sign-in account before upgrading, or 1.13.0 — which no longer signs anyone in automatically — locks the legitimate operators out along with the attackers. Ostorlab reports no exploitation of these CVEs and no KEV listing as of 30 October, but that sentence should be read next to the CVE-2025-3248 precedent, not as comfort. The bulletin also bundles dependency flaws including a Hono request-parameter issue (CVE-2026-84363), a reminder that the install base inherits its supply chain’s backlog too. A 403 from the auto_login endpoint means the unauthenticated path is closed; a 200 means the instance is already anyone’s. There is no middle reading.

What to do

  • Upgrade to 1.13.0 immediately if the instance is reachable by anyone you do not fully trust. Internet-facing, shared internal networks, and container networks all count — the attack is one GET request.
  • Probe the endpoint yourself first. A 200 from /api/v1/auto_login confirms a superuser session is being handed out; a 403 means automatic login is off. You lose nothing by checking from a machine you control.
  • Stage password sign-in before upgrading auto-login deployments. Follow the bulletin’s installation and Docker upgrade notes, or the fix locks you out with everyone else.
  • Treat the API keys on the instance as exposed. CVE-2026-110192 leaks operator-injected keys to authenticated accounts — rotate keys stored in Langflow alongside the upgrade.

Sources: