Langflow'dagi ikkita jiddiy zaiflik masofaviy hujumchiga, hech qanday hisob qaydnomasisiz, autentifikatsiyani chetlab o'tish yoki ixtiyoriy kodni ishga tushirishga imkon berishi mumkin, deb IBM o'tgan hafta ma'lum qildi.
Langflow — AI agentlari va ish oqimlarini yaratish uchun ochiq manbali vosita bo'lib, uning zaiflik hisobotlari IBM'ga yuboriladi. 1.0.0 dan 1.12.8 gacha bo'lgan har bir versiyada ushbu zaifliklar mavjud, va yagona tuzatish 1.13.0 versiyasidir.
Ushbu zaifliklardan hech biri, katalogning 30-oktabr yangilanishi holatiga ko'ra, CISA'ning Ma'lum Foydalanilgan Zaifliklar katalogida yo'q. U yerda Langflow'ning boshqa oltita zaifligi ro'yxatga olingan, eng yaqini CVE-2026-9198 bo'lib, u avgust oyida qo'shilgan.
IBM'ning 28-oktabrda birinchi marta e'lon qilingan va ertasi kuni yangilangan byulletenidagi to'rtta Langflow zaifligi quyidagilar:
| CVE | CVSS balli (IBM) | Hisob qaydi kerak | IBM aytishicha, nima qilishga imkon berishi mumkin |
|---|---|---|---|
| CVE-2026-93680 | 9.8 (Jiddiy) | Yo'q | Noto'g'ri autentifikatsiya tufayli xavfsizlik cheklovlarini chetlab o'tish |
| CVE-2026-110186 | 9.8 (Jiddiy) | Yo'q | Kod generatsiyasini noto'g'ri nazorat qilish tufayli ixtiyoriy kodni ishga tushirish |
| CVE-2026-110193 | 8.8 (Yuqori) | Ha, past huquqli hisob | Agentic Assistant'ni serverda operatsion tizim buyruqlarini bajaradigan komponent kodini yaratish yoki yuborishga majbur qilish |
| CVE-2026-110192 | 6.5 (O'rta) | Ha | Yetarlicha himoyalanmagan ma'lumotlardan sezgir ma'lumotlarni olish |
IBM ma'lumotiga ko'ra, zaifliklardan biri "model kontekst protokoli vositalarini sanash orqali foydalaniladigan autentifikatsiyasiz masofaviy kodni ishga tushirish"dir. Model Kontekst Protokoli (MCP) orqali Langflow o'z oqimlarini MCP'ni qo'llab-quvvatlaydigan AI ilovalariga vosita sifatida taqdim etishi mumkin.
Ommaviy Metasploit Framework'dagi modul allaqachon CVE-2026-93680, ya'ni autentifikatsiyani chetlab o'tish zaifligiga ishora qiladi. U Langflow serverining MCP nuqtasiga ma'lumotlarsiz ulanadi, sessiyani boshlaydi va server taqdim etadigan vositalarni ro'yxatga oladi. U serverda kod yoki buyruqlarni ishga tushirmaydi.
Uning muallifi ta'sirlangan versiyalar sifatida Langflow 1.5.0 dan 1.11.4 gacha bo'lgan torroq diapazonni ko'rsatadi, bu IBM ko'rsatgan diapazondan torroq.
Avtomatik kirish yoqilganda, Langflow foydalanuvchilarni superfoydalanuvchi sifatida, ulardan tizimga kirishni so'ramasdan, tizimga kiritadi. LANGFLOWAUTOLOGIN sozlamasi Langflow 1.12.8 da sukut bo'yicha yoqilgan. Uning kod tavsifi bu "autentifikatsiyani chetlab o'tadi va faqat ishlab chiqish muhitlarida ishlatilishi kerak" deb ogohlantiradi.
Modul Langflow 1.8.4 da avtomatik kirish yoqilgan holatda sinovdan o'tkazilgan. IBM ma'lumotiga ko'ra, to'rtta zaiflikdan yana biri "avtomatik kirish xavfsizlik nazoratining to'liq tuzatilmagan remediatsiyasi"dir. Byulleten avtomatik kirish o'chirilgan serverlar zaif ekanligi yoki yo'qligi haqida ma'lumot bermaydi.
1.13.0 ga yangilash
Langflow 1.13.0 22-oktabrda chiqqan. 1.12.8, o'sha kuni chiqqan, hali ham zaifliklarga ega, va PyPI'da 2-noyabr holatiga ko'ra 1.12 ning keyingi versiyasi ro'yxatga olinmagan. IBM hali yangilay olmaydigan serverlar uchun hech qanday vaqtinchalik yechim taklif qilmaydi.
Langflow 1.13 da avtomatik kirish sukut bo'yicha o'chirilgan. Yangilash uchun:
- Ma'lumotlar bazasi, maxfiy kalit va yuklangan fayllarni zaxiralang.
- Agar server avtomatik kirishdan foydalansa, mavjud hisobni parol bilan kirish uchun tayyorlang, Langflow'ning yangilash yo'riqnomasida tasvirlanganidek.
- Python paketini pip install --upgrade "langflow==1.13.0" bilan yangilang. Docker uchun langflowai/langflow:1.13.0 tasviriga o'ting va joylashtirishning doimiy ma'lumotlarini saqlang.
- Agar yangilashdan keyin tizimga kira olmasangiz, o'sha yo'riqnomada havola qilingan tiklash qadamlarini bajaring. Kirishni qayta tiklash uchun Langflow'ni o'chirmang yoki qayta o'rnatmang, chunki Langflow hujjatlari bu sizning oqimlaringizni doimiy ravishda o'chirib yuborishi mumkinligi haqida ogohlantiradi.
29-oktabrda IBM shuningdek Langflow'ning boshqa 29 ta zaifligi uchun CVE yozuvlarini e'lon qildi va ularning tuzatishlari sifatida 1.12.4 va 1.12.5 versiyalarini nomladi. Ulardan biri, CVE-2026-104339, hech qanday hisob qaydnomasisiz hujumchiga ixtiyoriy kodni ishga tushirishga ham imkon berishi mumkin, va IBM uni 9.8 deb baholaydi. Ushbu 33 ta yozuvning hech biri, shu jumladan ushbu to'rttasi ham, 1.13.0 ni ta'sirlangan deb ro'yxatga olmaydi.
Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week.
Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0.
Neither flaw is in CISA's Known Exploited Vulnerabilities catalog, as of the catalog's October 30 update. Six other Langflow flaws are listed there, most recently CVE-2026-9198, which was added in August.
The four Langflow flaws in IBM's bulletin, first published on October 28 and updated the next day, are:
| CVE | CVSS score (IBM) | Account needed | What IBM says it could allow |
|---|---|---|---|
| CVE-2026-93680 | 9.8 (Critical) | No | Bypassing security restrictions, because of improper authentication |
| CVE-2026-110186 | 9.8 (Critical) | No | Running arbitrary code, because of improper control of code generation |
| CVE-2026-110193 | 8.8 (High) | Yes, a low-privileged account | Making the Agentic Assistant generate or submit component code that runs operating system commands on the server |
| CVE-2026-110192 | 6.5 (Medium) | Yes | Getting sensitive information from insufficiently protected credentials |
One of the flaws is "unauthenticated remote code execution exploitable through model context protocol tool enumeration," according to IBM. Through the Model Context Protocol (MCP), Langflow can offer its flows as tools to AI apps that support MCP.
A module in the public Metasploit Framework already cites CVE-2026-93680, the authentication bypass. It connects to a Langflow server's MCP endpoint without credentials, starts a session, and lists the tools the server offers. It does not run code or commands on the server.
Its author lists Langflow 1.5.0 through 1.11.4 as affected, a narrower range than IBM's.
When automatic login is enabled, Langflow logs users in as superusers without prompting them to sign in. The setting LANGFLOWAUTOLOGIN is enabled by default in Langflow 1.12.8. Its code description warns that it "bypasses authentication and should only be used in development environments."
The module was tested on Langflow 1.8.4 with automatic login turned on. Another of the four flaws is "an incomplete remediation of an auto-login security control," according to IBM. The bulletin does not say whether servers with automatic login turned off are vulnerable.
Upgrading to 1.13.0
Langflow 1.13.0 came out on October 22. Version 1.12.8, released the same day, still has the flaws, and PyPI lists no later 1.12 release as of November 2. IBM offers no workaround for servers that cannot upgrade yet.
Langflow 1.13 turns automatic login off by default. To upgrade:
- Back up the database, the secret key and uploaded files.
- If the server uses automatic login, prepare the existing account for password sign-in, as Langflow's upgrade guidance describes.
- Upgrade the Python package with pip install --upgrade "langflow==1.13.0". For Docker, move to the langflowai/langflow:1.13.0 image and keep the deployment's persistent data.
- If you cannot sign in after upgrading, follow the recovery steps that the same guidance links to. Do not delete or reinstall Langflow to get access back, because Langflow's documentation warns this can permanently remove your flows.
On October 29, IBM also published CVE records for 29 other Langflow flaws and named versions 1.12.4 and 1.12.5 as their fixes. One of them, CVE-2026-104339, could also let an attacker with no account run arbitrary code, and IBM rates it 9.8. None of the 33 records, these four included, lists 1.13.0 as affected.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.