CVE-2026-93680: Langflow improper authentication

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication flaw (CWE-287) that lets an unauthenticated remote attacker bypass security restrictions, rated critical at CVSS 9.8 with network access, low complexity and no user interaction. Langflow is a visual builder for LLM agents and RAG flows that typically holds LLM API keys, vector database credentials and connectors to internal data. A bypass of its authentication can therefore expose those secrets and may lead to code execution through flow components. There is no CISA KEV listing, no public exploit and no Nuclei template yet, and EPSS data is not available, so exploitation is unconfirmed. However, the trivial attack profile and the broad Langflow footprint make internet-exposed instances a likely target once details circulate. Upgrade to the fixed release described in the IBM advisory (node 7294467) right away, and remove any Langflow instance from direct internet exposure until it is patched.

Sources:NVDibm.comATLAS

What is the risk?

High. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) means no credentials and no user interaction are needed. No active exploitation, public PoC, scanner template or KEV listing is known, and EPSS is unavailable, so real-world likelihood is unquantified. The vendor description is vague ("bypass security restrictions"), so the exact scope is uncertain. Exposure is highest for Langflow servers reachable from the internet or from broad internal networks, where compromise would give access to stored credentials, flows and connected data sources.

How does the attack unfold?

Initial Access

Attacker finds an exposed Langflow instance and bypasses authentication with crafted network requests.

AML.T0049

Credential Access

Attacker reads stored LLM API keys and database credentials from flows and configuration.

AML.T0055

Tool and Flow Abuse

Attacker modifies or creates flows to invoke connected tools, models and data sources.

AML.T0053

Impact

Attacker exfiltrates RAG data, abuses LLM accounts and pivots into internal systems.

AML.T0025

Initial Access

Attacker finds an exposed Langflow instance and bypasses authentication with crafted network requests.

AML.T0049

Credential Access

Attacker reads stored LLM API keys and database credentials from flows and configuration.

AML.T0055

Tool and Flow Abuse

Attacker modifies or creates flows to invoke connected tools, models and data sources.

AML.T0053

Impact

Attacker exfiltrates RAG data, abuses LLM accounts and pivots into internal systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

2.2%

chance of exploitation in 30 days

Higher than 82% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

✓Weaponized Metasploit module (auxiliary/gather/langflow_auth_bypass_cve_2026_93680)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade IBM Langflow OSS beyond 1.12.8 to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7294467). 2) Until patched, restrict network access to Langflow with a VPN, IP allowlist or authenticating reverse proxy, and do not expose it to the internet. 3) Rotate LLM API keys, vector DB credentials and other secrets stored in or reachable from Langflow if exposure is suspected. 4) Review access logs for unauthenticated requests to API and admin endpoints, unexpected flow creation or modification, and unusual outbound LLM or tool usage. 5) Run Langflow with least-privilege service accounts and network segmentation.

How is it classified?

Auth BypassData LeakageCode ExecutionFrameworkAgentRAGAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to AI risks are developed and documented

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-93680?

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication flaw (CWE-287) that lets an unauthenticated remote attacker bypass security restrictions, rated critical at CVSS 9.8 with network access, low complexity and no user interaction. Langflow is a visual builder for LLM agents and RAG flows that typically holds LLM API keys, vector database credentials and connectors to internal data. A bypass of its authentication can therefore expose those secrets and may lead to code execution through flow components. There is no CISA KEV listing, no public exploit and no Nuclei template yet, and EPSS data is not available, so exploitation is unconfirmed. However, the trivial attack profile and the broad Langflow footprint make internet-exposed instances a likely target once details circulate. Upgrade to the fixed release described in the IBM advisory (node 7294467) right away, and remove any Langflow instance from direct internet exposure until it is patched.

Is CVE-2026-93680 actively exploited?

A weaponized Metasploit module (auxiliary/gather/langflow_auth_bypass_cve_2026_93680) exists for CVE-2026-93680, meaning the exploit is point-and-click and the risk of opportunistic exploitation is high.

How to fix CVE-2026-93680?

1) Upgrade IBM Langflow OSS beyond 1.12.8 to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7294467). 2) Until patched, restrict network access to Langflow with a VPN, IP allowlist or authenticating reverse proxy, and do not expose it to the internet. 3) Rotate LLM API keys, vector DB credentials and other secrets stored in or reachable from Langflow if exposure is suspected. 4) Review access logs for unauthenticated requests to API and admin endpoints, unexpected flow creation or modification, and unusual outbound LLM or tool usage. 5) Run Langflow with least-privilege service accounts and network segmentation.

What systems are affected by CVE-2026-93680?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Visual flow builders.

What is the CVSS score for CVE-2026-93680?

CVE-2026-93680 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 2.18%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationVisual flow builders

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

Exploitation Scenario

An attacker scans for internet-exposed Langflow instances and sends crafted requests that exploit the improper authentication check to access protected API endpoints without valid credentials. They list flows and read stored credentials for LLM providers and vector databases. They then modify an existing flow or create a new one that adds a malicious component or exfiltrates data from connected RAG sources. The attacker abuses the stolen API keys for cost harvesting and uses the compromised host as a foothold into the internal network.

Weaknesses (CWE)

CWE-287Improper AuthenticationPrimary CWE-287Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.