Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2026-93680 (CVSS 9.8 Critical) - PoC Available Auth bypass in IBM Langflow (1.0.0–1.12.8) via /api/v1/mcp/sse lets remote attackers hijack MCP sessions and invoke tools. ⚡ Action: Upgrade past v1.12.8 or block /api/v1/mcp immediately. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93680/ https://t.co/ZBdXwv8WO2
#NØØT_Security_Alerts 🚨 #ALERT — Critical Authentication Bypass in IBM Langflow OSS October 28, 2026 PRODUCT: Langflow OSS. CVE: CVE-2026-93680. SEVERITY: CRITICAL — CVSS 9.8. AFFECTED VERSIONS: Langflow OSS 1.0.0 through 1.12.8. IMPACT: Improper authentication can permit a remote attacker to bypass security restrictions. IBM’s advisory identifies an incomplete remediation involving automatic-login security controls among the disclosed issues. EXPLOITATION STATUS: Vendor-confirmed vulnerability; no verified exploitation in the wild. Initial advisory October 28, updated October 29 to clarify remediation. FORENSIC TRIAGE: Examine unexpected authenticated sessions, auto-login configuration and abnormal API activity. URGENT ACTION: Upgrade to Langflow OSS 1.13.0. Back up deployment data and secret keys before upgrading. Prepare auto-login accounts for password authentication as instructed by IBM. SOURCE: https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2 CONFIDENCE: HIGH — IBM’s dated original security bulletin. #Langflow #AISecurity #AuthenticationBypass #CVE #CyberSecurity #AppSec
🔴 IBM Langflow OSS: security restriction bypass in authentication (CVE-2026-93680) A remote attacker can bypass security restrictions because authentication is improperly enforced. Patch → see advisory https://cve.now/CVE-2026-93680
ARETIQ Daily Vulnerability Bulletin — October 29, 2026 🔴 CRITICAL: CVE-2026-93680 (ibm/langflow_oss) AAS 12.4 — PoC on GitHub (nomi-sec/PoC-in-GitHub) 19 vulnerabilities — CRITICAL: 1, HIGH: 18 Full bulletin: https://aretiq.ai/bulletins/2026-10-29/
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langflow | langflow | - | - | - |