CVE-2026-93680

CriticalPublished

Langflow OSS is affected by multiple vulnerabilities

Published: Oct 29, 2026
Updated: Oct 30, 2026
Assigning CNA: ibm
Evidence observed: Sep 22, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

Langflow AI Authentication BypassModule
modules/auxiliary/gather/langflow_auth_bypass_cve_2026_93680.rb
Metasploit Framework modules
ResearchEvidence observed: Oct 8, 2026Revision: 7f838dd41ae0Related tool
Declared conditions
- verification: check_not_declared($.auxiliary_gather/langflow_auth_bypass_cve_2026_93680.check)

POC-CVE-2026-93680PoC
Proof-of-concept exploit for CVE-2026-93680 demonstrating MCP SSE authentication bypass and data exfiltration via tool invocation.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.