Langflow Unauthenticated RCE via MCP: Why Version 1.13.0 Is a Non-Negotiable Upgrade
IBM discloses critical vulnerabilities across Langflow 1.0.0 through 1.12.8, where default superuser auto-login and Model Context Protocol tool enumeration allow unauthenticated remote code execution.
Published: 2026.11.03
Visit Official SiteAll releases prior to 1.13.0 lack functional auth isolation
Unauthenticated RCE via CVE-2026-104339 & MCP flaws
Mandatory release enforcing disabled auto-login defaults
Architectural Breakdown: Default Auto-Login and Model Context Protocol Tool Enumeration
Langflow serves as an orchestration engine for low-code AI workflows and autonomous agents. The vulnerability disclosures published by IBM reveal a compounding architectural failure: unauthenticated Model Context Protocol (MCP) endpoints combined with default superuser auto-login credentials. In releases spanning version 1.0.0 through 1.12.8, the server runtime leaves internal execution pipelines accessible across external interfaces without cryptographic session verification.
The primary attack vector exploits Langflow’s implementation of the Model Context Protocol. Langflow exposes internal agent workflows as callable tools to external AI runtimes over MCP endpoints. When LANGFLOW_AUTO_LOGIN remains enabled—which was the default configuration up to version 1.12.8—the platform automatically assigns superuser permissions to any inbound connection without prompting for authentication. An attacker queries the MCP endpoint, initiates an unauthenticated session, enumerates every registered workflow tool, and invokes arbitrary execution primitives on the underlying host.
Exploitation flow from perimeter scanning to remote code execution
Adversary probes exposed HTTP port hosting Langflow MCP endpoint
LANGFLOW_AUTO_LOGIN grants root superuser role without auth challenge
MCP interface returns registered flows, Python runtimes, and secrets
Attacker triggers arbitrary Python primitives directly on server host
A public module in the Metasploit Framework already automates the authentication bypass tracked under CVE-2026-93680. The module connects directly to the target MCP endpoint, establishes an authenticated session state without credentials, and extracts the full inventory of operational tools. While the initial public module limits itself to enumeration, chained exploits leverage unauthenticated execution sinks—such as CVE-2026-104339 (CVSS 9.8)—to execute arbitrary shell commands inside the container runtime.
Langflow’s maintainers attempted an earlier fix in version 1.12.8, released simultaneously with 1.13.0. However, IBM confirmed that 1.12.8 remains vulnerable due to an incomplete remediation of the auto-login bypass logic. Because Langflow instances frequently hold persistent API keys for production vector databases, foundational model providers, and internal enterprise data lakes, an unauthenticated compromise yields immediate lateral expansion across the hosting cloud environment.
Vulnerability Profile, Version Exposure, and Remediation Telemetry
The attack surface spans 33 distinct CVE records published by IBM across late October, reflecting systemic vulnerabilities within Langflow’s request dispatchers and authentication middleware. While CISA’s Known Exploited Vulnerabilities (KEV) catalog lists six prior Langflow vulnerabilities (including CVE-2026-9198 added in August), these newly disclosed MCP bypasses carry an identical operational risk profile.
Breakdown of the default permission failure across releases 1.0.0 through 1.12.8
LANGFLOW_AUTO_LOGIN defaulted to true, treating all incoming traffic as superuser
Model Context Protocol endpoints exposed raw tool invocation without ACL verification
Disables auto-login by default and completely deprecates permissive MCP handlers
Organizations hosting Langflow on public clouds or internal corporate networks face immediate exposure if running any version prior to 1.13.0. The following matrix contrasts the operational specifications, attack vectors, and structural mitigations between legacy Langflow deployments and the patched release.
| Technical Parameter | Langflow v1.0.0–v1.12.8 (Legacy) | Langflow v1.13.0 (Patched Release) | Hardened Gateway Baseline |
|---|---|---|---|
| Authentication Enforcement | Bypassable via LANGFLOW_AUTO_LOGIN | Enforced; auto-login disabled by default | mTLS + Identity Provider (IdP) SSO |
| MCP Tool Enumeration | Publicly accessible without tokens | Requires validated session token | Blocked at ingress via API Gateway |
| Peak CVSS Vulnerability | 9.8 Critical (CVE-2026-104339) | Resolved (0 known unpatched CVEs) | Insulated via WAF & network policy |
| Superuser Provisioning | Automatic on unauthenticated HTTP hits | Manual admin provisioning required | Role-Based Access Control (RBAC) |
| Official Vendor Workaround | None provided by IBM | Full software release upgrade | Network isolation / ingress shutdown |
| Exploitation Prerequisite | Direct TCP/HTTP access to web port | Valid credentials with execution role | Compromised service account + mTLS |
For an enterprise operating 15 distributed Langflow container pods, the threat profile extends beyond server availability. If an instance compromises just three foundational API secrets, forensic discovery and credential rotation across corporate LLM providers average 36 to 72 engineering hours. Because IBM verified that no configuration-only workaround resolves the vulnerability in unpatched binaries, maintaining older containers incurs an unsustainable compliance and breach liability.
Langflow 1.12.8 vs Langflow 1.13.0 architectural controls
- • LANGFLOW_AUTO_LOGIN enabled out of the box
- • Unauthenticated MCP tool enumeration permitted
- • Arbitrary code execution via chainable CVEs
- • Auto-login strictly disabled by default
- • Zero active unauthenticated CVEs listed
- • Mandatory session credential validation
Production Containment Mandate: Remediation Protocol and Perimeter Defense
Security engineering teams must treat any Langflow instance deployed before version 1.13.0 as potentially accessible to unauthorized actors if exposed to routable networks. Because Metasploit modules already target these endpoints, remediation must proceed in a coordinated three-step sequence.
Sequential execution plan for infrastructure and security teams
Sever public routing to Langflow ports 7860/MCP endpoints via security groups
Update Dockerfile/Helm charts to langflow:1.13.0 and verify container hashes
Revoke and reissue all API keys, database credentials, and MCP tokens stored in flows
Ingress Severance and Gateway Containment
Langflow instances should never face the public internet without an authenticating reverse proxy. While awaiting container patching, teams must restrict network access using private subnets, enterprise VPNs, or identity-aware proxies (such as Cloudflare Access or AWS Application Load Balancers integrated with OIDC).
- Port Isolation: Block public ingress on default application ports (typically TCP port 7860) and any custom MCP listening ports.
- WAF Inspection: Drop inbound POST requests directed at
/api/v1/mcpand tool registration paths originating from untrusted CIDR blocks. - Service Mesh Policies: Apply strict Kubernetes NetworkPolicies allowing only authorized API gateways to communicate with Langflow pods.
Image Migration to Langflow 1.13.0
Teams must rebuild container images and update Helm values or Docker Compose definitions immediately. Because version 1.12.8 was published concurrently with 1.13.0 on October 22, pipeline automation that pins minor versions without patch verification may pull the still-vulnerable 1.12.8 release.
- Set base container image declarations explicitly to
langflowai/langflow:1.13.0. - Explicitly enforce
LANGFLOW_AUTO_LOGIN=falsein environment manifests as a defense-in-depth measure. - Audit persistent SQLite or PostgreSQL backends to verify that unauthorized superuser accounts were not provisioned prior to the upgrade.
Cryptographic and Identity Revocation
Because Langflow workflows store plaintext or weakly protected environment variables for external integrations, any unauthenticated enumeration may have leaked downstream service credentials.
- Foundational Model Keys: Rotate all enterprise API keys for OpenAI, Anthropic, Google Vertex AI, and Hugging Face loaded into existing canvases.
- Storage and Vector Endpoints: Cycle credentials for Pinecone, Weaviate, Qdrant, and relational database connections referenced in deployed flows.
- Log Review: Inspect ingress controller access logs for anomalous GET and POST requests against
/api/v1originating from unrecognized external IP addresses over the preceding 60 days.