Zero Radar
← feed
CriticalVulnerabilityCVE-2026-93680updated 30 Oct 2026, 10:50 UTC

Langflow: attackers can bypass security checks without logging in

Langflow is a tool for building AI workflows. A flaw lets someone outside your network skip the login checks and get access they should not have.

Official, 3 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

What happened

IBM Langflow OSS versions 1.0.0 through 1.12.8 have an improper authentication flaw that allows a remote attacker to bypass security restrictions. CERT-Bund reports several related Langflow vulnerabilities that could allow code execution, denial of service, information disclosure, file manipulation and security control bypass.

Why it is dangerous: A remote attacker could get past access restrictions on the Langflow server, which may expose data, change files or disrupt the service. Anyone running an affected Langflow instance that is reachable from the network is at risk.

Are you affected?

You are affected if you run IBM Langflow OSS version 1.0.0 through 1.12.8 and it is reachable by untrusted users or the internet.

IBM Langflow OSS 1.0.0 through 1.12.8

What to do

  1. Check whether your Langflow version is between 1.0.0 and 1.12.8
  2. Update Langflow to a fixed version as published in the official IBM or GitHub advisory
  3. Restrict network access to Langflow until the update is applied
  4. Review logs for unexpected access to Langflow

Timeline

  1. 29 Oct 2026, 16:20 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:20 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 16:20 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 20:34 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 10:50 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-93680 · GHSA-vfwm-g9g9-v2g5
CVSS
9.8 / 10
EPSS
2.2% chance of exploitation within 30 days
Disclosed
29 Oct 2026, 16:20 UTC
On Zero Radar
29 Oct 2026, 16:20 UTC (0 min after disclosure)
Last change
30 Oct 2026, 10:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Langflow: attackers can bypass security checks without logging in · Zero Radar