CVE-2026-93680

Langflow MCP authentication bypass exposes privileged information

IBM / Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

Privileged MCP information disclosure and bypass of access restrictions. The reviewed module does not itself demonstrate arbitrary host execution.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Public PoC and Metasploit module available; their presence does not establish use against real victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The published Metasploit module connects to MCP SSE without authentication and enumerates session, server and tool information; IBM confirms an authentication bypass.

Conditions required

A reachable vulnerable MCP endpoint; no application credentials are required for the documented module path.

Potential impact

Privileged MCP information disclosure and bypass of access restrictions. The reviewed module does not itself demonstrate arbitrary host execution.

Affected versions and configurations

IBM lists Langflow OSS 1.0.0 through 1.12.8.

Fix and mitigation status

1.13.0 per IBM; this is an issue-specific fix, not assurance that the old release addresses later findings.

Practical next steps

Upgrade to a current supported release containing the fix; back up the deployment and validate workflow behavior.

Operating lesson

Authenticate every MCP transport and verify that disabling automatic login actually closes alternate entry points.

Evidence and limits

The original public Metasploit issue and PR explicitly name this CVE on September 22; the module merged October 8. Research-repository commits date September 21, but their timestamps alone do not prove public availability then. IBM’s October 28 bulletin and October 29 CNA are later. The module covers 1.5.0–1.11.4, while IBM lists 1.0.0–1.12.8 and fixes 1.13.0; those scopes are not interchangeable. IBM’s grouped summary mentions incomplete auto-login remediation without a detailed per-CVE mapping.

Sources