Langflow 1.13.0 Security Upgrade: Patch Critical CVEs

If you run Langflow (the open-source visual builder for AI agents and workflows), treat the IBM security bulletin from late October 2026 as an upgrade-now notice. Langflow OSS 1.0.0 through 1.12.8 is affected by four issues, two of them critical. The only fixed release IBM names is 1.13.0. There is no workaround.

I wrote this as a practical checklist: what the CVEs mean in plain terms, how they relate to auto-login and MCP, what broke in 1.13.x, and the exact pip and Docker steps so you do not wipe an install while recovering login.

What is Langflow, and why this matters

Langflow is a low-code UI and runtime for chaining LLMs, tools, RAG, and agents. Teams use it for prototypes and for long-lived internal agent servers. Through the Model Context Protocol (MCP), a Langflow instance can expose flows as tools that other AI apps call. That is useful, and it is also why an authentication gap next to MCP tooling is high severity.

IBM owns the vulnerability reports for Langflow OSS. The bulletin published on 28 October 2026 (updated 29 October) covers four Langflow CVEs plus three bundled Hono dependency issues fixed in Hono 4.13.5.

The four Langflow CVEs in 1.13.0

Scores below are IBM's CVSS 3.1 base scores from the IBM security bulletin.

IBM also lists three Hono issues fixed in Hono 4.13.5 and shipped with the Langflow upgrade path: CVE-2026-84363 (5.9), CVE-2026-84364 (5.3), and CVE-2026-84365 (6.5). You do not patch those separately when you move Langflow to 1.13.0; they are dependency story.

Auto-login, MCP, and why 9.8 is not marketing

When LANGFLOW_AUTO_LOGIN is enabled, Langflow signs users in as the configured superuser without a password prompt. The Langflow authentication docs state that official packages and Docker images now default this to false. The Hacker News (2 Nov 2026) notes that in 1.12.8 the default was still true, and the code description itself warns that auto-login bypasses authentication and belongs in development only.

CVE-2026-93680 is described by IBM as an incomplete remediation of that auto-login control. CVE-2026-110186 is the unauthenticated RCE path through MCP tool enumeration. A public Metasploit Framework module already cites CVE-2026-93680: it connects to a Langflow MCP endpoint without credentials, starts a session, and lists tools. THN reports that the module does not itself run OS commands, and that its listed version range (1.5.0–1.11.4) is narrower than IBM's 1.0.0–1.12.8. Treat IBM's range as the one that decides whether you upgrade.

If you have been following MCP security posts on this blog, the pattern will look familiar: a convenient protocol surface plus weak auth becomes remote reachability. The Prefab UI / FastMCP CVE write-up is a different stack, but the lesson is the same: check the versions you actually run, not only the top-level framework name.

Are these in CISA KEV?

No. THN checked CISA's Known Exploited Vulnerabilities catalog as of the 30 October 2026 update: these four are not listed. Six older Langflow flaws are in KEV, most recently CVE-2026-9198 (added August 2026).

Breaking changes in Langflow 1.13.x you must plan for

From the 1.13.x release notes:

• Authentication required by default on official Python packages, tagged archives, and Docker images: LANGFLOW_AUTO_LOGIN=false. Set LANGFLOW_SUPERUSER_PASSWORD, then sign in as langflow or the username in LANGFLOW_SUPERUSER.
• Chroma and Local DB components removed. Local Knowledge and Memory use SQLite. Replace Chroma / Local DB with a knowledge base or a supported remote vector store.
• Useful additions if you stay on 1.13: audit logging (LANGFLOW_AUDIT_ENABLED), Connections, concurrent editing protection, instance migration, and an administration API/CLI.

Prepare password sign-in before you cut over an auto-login instance. Setting LANGFLOW_SUPERUSER_PASSWORD alone does not reset an existing account's non-legacy password. Langflow's docs walk through identifying the current account, setting a password on that same user, then disabling auto-login.

Langflow upgrade checklist (pip and Docker)

Use this as a runbook. Order matters.

1. Inventory version on every host that runs Langflow (see the snippet below).
2. Export or back up projects/flows, the database, LANGFLOW_SECRET_KEY / secret key file, and uploaded files.
3. If auto-login is on, set a strong password on the existing superuser while you still have access (Langflow "Upgrade an existing auto-login installation" guidance).
4. Upgrade to 1.13.0 or newer with pip or Docker (commands below). Keep the same database and config directory.
5. Remove any explicit LANGFLOW_AUTO_LOGIN=true override, or set it to false.
6. Sign in as langflow or LANGFLOW_SUPERUSER and confirm flows, API keys, and files are present.
7. Audit MCP exposure: who can reach the MCP endpoint, and whether the host should be on a private network only.
8. Watch for Chroma / Local DB components that need replacement after 1.13.

Pip

# Prefer a fresh venv for the first cutover test, then upgrade prod.
python3 -m venv .venv-langflow-113
source .venv-langflow-113/bin/activate

pip install --upgrade "langflow==1.13.0"
# Or track the 1.13 line (PyPI also has 1.13.1 as of 6 Nov 2026):
# pip install --upgrade "langflow>=1.13.0"

cat > .env <<'EOF'
LANGFLOW_AUTO_LOGIN=false
LANGFLOW_SUPERUSER_PASSWORD=REPLACE_WITH_A_STRONG_PASSWORD
# Optional if the existing account is not named "langflow":
# LANGFLOW_SUPERUSER=your_existing_username
EOF

uv run langflow run --env-file .env
# or: python -m langflow run --env-file .env

Docker

Pin the image IBM names, keep volumes, and require a superuser password. Full volume-migration notes are in the Docker upgrade docs.

docker pull langflowai/langflow:1.13.0

docker run -d --name langflow \
  -p 7860:7860 \
  -v langflow-data:/app/langflow \
  -e LANGFLOW_CONFIG_DIR=/app/langflow \
  -e LANGFLOW_SAVE_DB_IN_CONFIG_DIR=true \
  -e LANGFLOW_AUTO_LOGIN=false \
  -e LANGFLOW_SUPERUSER_PASSWORD='REPLACE_WITH_A_STRONG_PASSWORD' \
  langflowai/langflow:1.13.0

Compose example (abbreviated): set image: langflowai/langflow:1.13.0, mount persistent data, set LANGFLOW_DATABASE_URL or LANGFLOW_SAVE_DB_IN_CONFIG_DIR=true, and pass LANGFLOW_SUPERUSER_PASSWORD from a .env file. On Linux, create the bind-mount directory and chown it to UID 1000 before first start so Langflow can write.

Confirm the installed version

python - <<'PY'
from importlib.metadata import version, PackageNotFoundError
try:
    print("langflow", version("langflow"))
except PackageNotFoundError:
    print("langflow not installed in this interpreter")
PY

# Docker
docker image inspect langflowai/langflow:1.13.0 --format '{{.RepoTags}} {{.Id}}'

Anything below 1.13.0 on an OSS install in the 1.x line is still in the IBM affected range until you move.

After you patch

• Rotate any API keys or provider credentials that lived on a previously exposed host (CVE-2026-110192 is the credentials disclosure item; assume compromise if the server was reachable).
• Turn on audit logging if you need an append-only trail of who changed flows and projects (LANGFLOW_AUDIT_ENABLED=true in 1.13).
• Keep agent and LLM gateway stacks patched the same way you treat Langflow. Related reading on this site: the LiteLLM 1.107.0 compromise response and the Microsoft Agent Framework guide if you are evaluating other agent runtimes.

I am not claiming these four CVEs are under active mass exploitation as of writing. I am saying the CVSS scores, the MCP unauth path, a public Metasploit module that cites the auth bypass, and IBM's "no workaround" wording are enough to schedule the upgrade this week rather than next quarter.