← Back to Feed CACHED · 2026-11-02 15:49:01 · CACHE_KEY CVE-2026-93680
CVE-2026-93680 · CWE-287 · Disclosed 2026-10-29

IBM Langflow OSS improper authentication bypass via MCP session creation

ASSESSED — NOISGATE
Vendor
—
—
—
Reassessed
—
—
—
Verdict: —
Do you agree?
01 · The Real Story

A locked lab door that opens for anyone, exposing the experiments running inside

IBM Langflow OSS versions 1.0.0 through 1.12.8 fail to properly authenticate requests to its Model Context Protocol (MCP) endpoints. An unauthenticated remote attacker can create an MCP session and enumerate available tools, and potentially access other authenticated Langflow API routes. The flaw is fixed in 1.13.0.

IBM rates this CRITICAL (CVSS 9.8), but that score assumes full confidentiality, integrity and availability impact from a single authentication bypass. The public Metasploit module demonstrates only session creation and tool enumeration — not arbitrary code execution. In practice, impact depends on whether an exposed instance has dangerous flows or stored credentials; many Langflow deployments sit on localhost or internal networks. A downgrade from vendor CRITICAL to HIGH reflects that friction.

"The bouncer is gone at the Langflow door, and a public Metasploit module already knows the doorknob turns."
02 · The Attack Path

5 steps from start to impact.

STEP 01

Discover exposed Langflow instance

Attacker scans for Langflow's web/MCP port, typically 7860 or 8090, using Shodan or masscan. Instances with auto-login enabled or the vulnerable MCP endpoint respond without authentication.
Conditions required:
  • Network reachability to Langflow UI/MCP port
  • Service not filtered by firewall/ACL
Where this breaks in practice:
  • Most Langflow deployments run on localhost or private networks
  • Shodan/Censys footprint is not widely reported for this product
Detection/coverage: Shodan search for product fingerprint; no dedicated Nmap script yet.
STEP 02

Create unauthenticated MCP session

The attacker sends a JSON-RPC initialize or tools/list message to the MCP endpoint without any Authorization header. A public Metasploit module automates this step for CVE-2026-93680.
Conditions required:
  • MCP server enabled (default?)
  • No reverse proxy enforcing auth
Where this breaks in practice:
  • If LANGFLOW_AUTO_LOGIN is disabled, other endpoints may still require auth, but the MCP bypass remains
  • Non-standard MCP header may be blocked by some WAFs
Detection/coverage: Metasploit module auxiliary/gather/langflow_mcp_enum (or similar) can detect; WAF logs may show JSON-RPC POSTs.
STEP 03

Enumerate MCP tools and API routes

With a session established, the attacker calls tools/list to enumerate functions exposed by Langflow flows. This reveals tool names, parameters, and connected services.
Conditions required:
  • At least one flow published as MCP tool
Where this breaks in practice:
  • Fresh default install may have no published tools
  • Tool enumeration alone does not execute anything
Detection/coverage: IDS/host logs may record unusual JSON-RPC tools/list from untrusted IP.
STEP 04

Invoke exposed tools or read flow definitions to exfiltrate API keys

If enumerated tools are dangerous, the attacker can call them to execute code, query connected databases, or trigger LLM actions. Alternatively, accessing authenticated Langflow API routes may let them read flow JSON containing provider API keys.
Conditions required:
  • A flow with code execution, database, or secret-bearing components exists
  • The bypass extends to flow-create/read endpoints; otherwise only published tools
Where this breaks in practice:
  • Requires admin-created dangerous flows; not guaranteed in default install
  • Stored secrets may be masked but often recoverable from component definitions
Detection/coverage: API access logs show anomalous flow reads; secret scanning in repos does not apply.
STEP 05

Pivot to connected services using stolen credentials

The attacker uses exposed API keys or tool capabilities to access connected LLM providers, data stores, or internal services. This can escalate to data exfiltration or lateral movement.
Conditions required:
  • Exposed credentials are valid and not scoped-down
  • Connected services are reachable from the compromised host
Where this breaks in practice:
  • Cloud-provider key permissions may be limited
  • MFA on connected services probably not bypassed
Detection/coverage: Cloud provider logs (GuardDuty, CloudTrail) show unusual API calls from Langflow host.
03 · Compensating Control

1
HIGH 7.5→IGNORE 0.0
SEVERITY REDUCED
Upgrade Langflow OSS to 1.13.0 — Apply the vendor fix within the noisgate mitigation SLA for HIGH (≤30 days). This closes the authentication bypass; schedule full rollout within 180 days per noisgate remediation SLA. Back up flows and configuration first.
2
HIGH 7.5→MEDIUM 4.0
SEVERITY REDUCED
Restrict network access to Langflow UI and MCP port — Until the upgrade, place Langflow behind a firewall/VPN so only trusted clients can reach port 7860/8090. This breaks attacker precondition of network reachability. Deploy within 30 days.
3
HIGH 7.5→MEDIUM 5.0
SEVERITY REDUCED
Disable MCP server or LANGFLOW_AUTO_LOGIN if not required — Set LANGFLOW_AUTO_LOGIN=false and disable MCP endpoint if unused. This removes the documented unauthenticated session creation path, but other API endpoints may still be reachable.
4
HIGH 7.5→LOW 2.5
SEVERITY REDUCED
Audit Langflow flows and rotate exposed API keys — Review stored components for cloud provider keys, database credentials, or LLM tokens. Rotate any that may have been reachable without auth. Deploy within 30 days as part of incident-response hygiene.
What doesn't work
  • WAF signature blocks: the Metasploit module sends standard JSON-RPC over HTTP; a generic WAF may not flag tools/list as malicious, so WAF alone is not reliable.
  • Network segmentation without disabling MCP: if internal users or AI clients still need access, the bypass remains exploitable from any compromised internal host.
  • Monitoring alone: post-compromise detection may see the session, but does not prevent unauthenticated access; use it only as an addition to mitigation.
04 · Intelligence Metadata

The supporting signals.

In-the-wild statusNo known active exploitation campaigns; CISA KEV does not list this CVE as of 2026-10-30. A public Metasploit module exists, lowering barrier for opportunistic attackers.
PoC availabilityMetasploit module reported by Mallory demonstrates unauthenticated MCP session creation and tool enumeration; no public RCE PoC for this CVE alone.
EPSS score and percentileEPSS 0.02181 (2.18% probability in next 30 days); percentile not provided by source, but low interest relative to critical flaws.
KEV status and datesNot in CISA KEV as of October 30, 2026.
CVSS vector and interpretationCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — vendor assumes full C/I/A impact from auth bypass; realistic impact depends on accessible flows and stored secrets.
Affected versionsLangflow OSS 1.0.0 through 1.12.8 (all releases in that range).
Fixed versionsLangflow OSS 1.13.0; no workaround; see IBM bulletin.
Scanning/exposure dataNo Shodan/Censys/GreyNoise exposure data provided in sources; typical self-hosted AI tool deployments are internal, so public attack surface likely low.
Disclosure date2026-10-29 (CVE assigned 2026-09-18).
Reporting researcher/organizationIBM (vendor advisory), CVE published via MITRE/NVD.

Sources.

  1. IBM Security Bulletin: Langflow OSS affected by multiple vulnerabilities
  2. Mallory: Critical Langflow Flaws Expose Servers to Unauthenticated Code Execution
  3. VulDB CVE-2026-93680
  4. KomodoSec CVE-2026-93680
  5. SecAlerts CVE-2026-93680
  6. it-boltwise: Langflow critical vulnerabilities allow auth bypass and code execution up to 1.12.8
05 · The Call

Final Verdict
↓ DOWNGRADED to HIGH (7.5/10)

Why this verdict

  • Role multiplier: Langflow is not a canonical high-value-role component (not IdP, CA, hypervisor, backup, edge, or CI/CD); typical deployments are application-tier AI builder servers. If an enterprise instance exposes dangerous flows or stored API keys, unauthenticated access can lead to mass data egress or cloud pivot, flooring the verdict at HIGH, but it does not justify CRITICAL floor under the 10% high-value-role criterion.
  • Friction audit: exploit requires network reachability to the MCP/API endpoint; many Langflow instances run on localhost or private networks, reducing the exposed population. Public exposure data is sparse, and the Metasploit PoC only demonstrates session creation and tool enumeration, not RCE.
  • Public PoC lowers barrier: a public Metasploit module exists, so any exposed instance can be discovered and exploited with low skill; fixed only in 1.13.0 with no workaround, so this is not LOW.

Why not higher?

Not CRITICAL because the vendor 9.8 score assumes full impact from authentication bypass alone, but the documented PoC stops at session creation and tool enumeration. There is no observed active exploitation, no KEV listing, and no confirmed RCE path without a pre-existing dangerous flow. The affected component is not a canonical high-value role, so the CRITICAL floor does not automatically apply.

Why not lower?

Not MEDIUM because the vulnerability is remotely exploitable without credentials, a public Metasploit module lowers exploitation cost, and Langflow commonly holds API keys or connects to sensitive tools when deployed in enterprise AI workflows. If exposed, the auth bypass can lead to credential theft and lateral movement, which is more than a low-severity defect.

06 · Verification

Crowdsourced verification payload.

Run on the host or container where Langflow is installed. Requires shell access as the user that owns the Langflow process. Invoke: bash check_cve-2026-93680.sh. The script checks installed Langflow version and environment variables, then outputs VULNERABLE, PATCHED, or UNKNOWN.

noisgate-verify.sh
BASHREAD-ONLYSAFE
#!/usr/bin/env bash
set -euo pipefail

# CVE-2026-93680 - IBM Langflow OSS auth bypass
# Checks installed Langflow version (<1.13.0 vulnerable) and LANGFLOW_AUTO_LOGIN.

VULNERABLE=0
PATCHED=0
UNKNOWN=0

# Try pip package first
if command -v python3 >/dev/null 2>&1; then
    version=$(python3 -c "import importlib.metadata; print(importlib.metadata.version('langflow'))" 2>/dev/null || echo "")
elif command -v langflow >/dev/null 2>&1; then
    version=$(langflow --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "")
fi

if [ -z "$version" ]; then
    # maybe docker image
    if docker inspect langflow:latest >/dev/null 2>&1; then
        version="docker-unknown"
    else
        echo "UNKNOWN"
        exit 3
    fi
fi

# Compare version with Python
if [ "$version" != "docker-unknown" ]; then
    if python3 -c "import sys; from packaging.version import Version; sys.exit(0 if Version('$version') < Version('1.13.0') else 1)" 2>/dev/null; then
        VULNERABLE=1
    else
        # packaging not available, use sort
        if [ "$(printf '%s\n' '1.13.0' "$version" | sort -V | head -n1)" != "1.13.0" ]; then
            VULNERABLE=1
        else
            PATCHED=1
        fi
    fi
else
    # docker unknown, check env variable
    if docker inspect langflow:latest | grep -q "LANGFLOW_AUTO_LOGIN"; then
        VULNERABLE=1
    else
        UNKNOWN=1
    fi
fi

if [ $VULNERABLE -eq 1 ]; then
    echo "VULNERABLE"
    exit 1
elif [ $PATCHED -eq 1 ]; then
    echo "PATCHED"
    exit 0
else
    echo "UNKNOWN"
    exit 3
fi