IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
Fix
Public exploits 2
- Langflow AI Authentication Bypass (auxiliary module) Metasploit · 2026-09-22
- rmhowe425/POC-CVE-2026-93680 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://www.ibm.com/support/pages/node/7294467 vendor-advisory, patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 1
Change history 1
- First seenCVSS 9.8 · ibmNVD modified 2026-10-29 15:18
Affected (CPE criteria) 2
cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:langflow_oss:1.12.8:*:*:*:*:*:*:*
References 1
- https://www.ibm.com/support/pages/node/7294467 vendor-advisory, patch