Last checked against sources: 29 October 2026.
Langflow OSS users should move to version 1.13.0 or later. IBM’s 28 October bulletin covers critical vulnerabilities that still affect versions through 1.12.8. The older 1.12.4 and 1.12.5 fixes address earlier defects, so those releases do not meet the new upgrade target.
This matters if your team runs its own Langflow server to build AI agents and workflows. The six critical vulnerabilities below have different access needs. Some require a signed-in account; others do not. This article compares those paths and the actions an administrator needs to take.
Three Patch Steps, One Current Upgrade Target
IBM published the first two bulletins on 19 October. One covers versions 1.0.0 through 1.12.3; the next extends through 1.12.4. The 28 October bulletin reaches through 1.12.8. Read each fixed version as a step in that history, rather than a complete answer to the later notice.
- Affected
- Fixed
The matrix shows only the six critical vulnerabilities discussed here. The bulletins also cover other defects and dependencies. IBM’s latest instruction is to upgrade Langflow OSS to 1.13.0 or later, which avoids treating an older patch threshold as the end of the work.
The CVE records for these six identifiers were published on 29 October. That record date is distinct from the earlier bulletin dates. It does not establish when an attack took place or when a patch first became available.
Which Paths Need an Account?
The following details come from IBM’s three bulletins and its CVE records. CVSS scores describe the published severity, not the chance that your own server has been attacked. The access column is part of the risk: a low-privileged account is still an account.
| CVE | CVSS 3.1 | Access and Impact | Affected Through | First Fixed |
|---|---|---|---|---|
| CVE-2026-104339 | 9.8 | No account needed. Arbitrary code execution. | 1.12.3 | 1.12.4 |
| CVE-2026-107327 | 9.9 | Low privileges. Missing authorization allows arbitrary code execution. | 1.12.4 | 1.12.5 |
| CVE-2026-107328 | 9.9 | Low privileges. Improper neutralization in eval/exec allows arbitrary code execution. | 1.12.4 | 1.12.5 |
| CVE-2026-107329 | 9.9 | Low privileges. Improper control of code generation allows arbitrary code execution. | 1.12.4 | 1.12.5 |
| CVE-2026-93680 | 9.8 | No account needed. Improper authentication allows a security-restriction bypass. | 1.12.8 | 1.13.0 |
| CVE-2026-110186 | 9.8 | No account needed. Improper control of code generation allows arbitrary code execution. | 1.12.8 | 1.13.0 |
Each affected range starts at 1.0.0. IBM rates every path in this table as network reachable, low complexity and requiring no user interaction. Do not combine the rows into one proven exploit chain. Code execution and an authentication bypass are separate claims with separate identifiers.
Langflow can connect workflows to tools and outside services. That makes server-side code execution an access concern as well as an uptime concern. Assess which credentials and integrations the affected process can reach. This is a review priority, not evidence that all installations lost secrets.
Our MCP server security scenarios explain the wider trust boundaries around tool access. Those protocol scenarios provide context; they do not prove an exploit for these six CVEs. Likewise, the older Langflow CVE-2025-3248 profile concerns a different vulnerability.
Retain the Extra Controls for MCP Stdio
IBM’s 19 October bulletin gives two settings for deployments that use MCP stdio. It explicitly requires them in addition to the upgrade. They restrict how the server launches tools and who can use that path.
- Set
LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=trueto reject direct shell-script execution. - Set
LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=trueto block non-admin MCP stdio access. - Restart Langflow after changing its environment configuration.
These controls can require changes to existing MCP server launch settings. They can also limit which users can use MCP stdio. Plan a flow test after the change so a working application does not silently lose a required integration.
For public workflows, IBM says to keep the default restriction on custom components. Enabling LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS changes the default protection described for CVE-2026-18894. That is a separate issue, not another name for one of the six critical rows.
A scanner check is useful alongside a version check. Our MCP scanner test shows what a tool-focused audit can and cannot see. Do not treat a clean scan as proof that an affected Langflow build has the code fixes.
An Upgrade Cannot Recall an Exported Secret
The same IBM bulletin describes CVE-2026-77817 in flow and project exports. The fix prevents the identified secret disclosure in new exports. It cannot remove a secret from an old copy that has already left the server.
Review old exports under your incident process and revoke or rotate any credentials they exposed. Keep this task separate from installing a new build. The patch management process should track both the installed version and the follow-up work on old artifacts.
Before closing the change, record the deployed build, the relevant MCP stdio settings and the result of flow testing. Assign an owner for old export review. Those checks answer different questions: whether code was fixed, whether access was narrowed and whether an exposed secret still works.
- CISA KEVNot seenThese six CVEs were not listed in the checked catalogue. This is not proof of no attacks.29 October 2026
- Public PoC claimYesOne README claims an authentication-bypass PoC for CVE-2026-93680. We did not run or validate it.29 October 2026
- Confirmed attacksUnknownThe opened IBM notices do not establish an active campaign for these six identifiers.29 October 2026
The PoC claim is a signal to assess, not a tested result from Brandefense. We read public repository descriptions and README text only. We did not execute exploit code or probe a Langflow deployment. Prioritize the update from the vendor’s affected range rather than waiting for a demonstration.