CVE-2026-93680: 
Homebrew Análisis y mitigación de vulnerabilidades

CVE-2026-93680 is an improper authentication vulnerability in IBM Langflow OSS that allows remote, unauthenticated attackers to bypass security restrictions. It affects IBM Langflow OSS versions 1.0.0 through 1.12.8, with the fix available in version 1.13.0 (or 1.12.9 and later). The vulnerability was published on October 29, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, IBM Advisory).

The root cause is classified as CWE-287 (Improper Authentication), meaning the application fails to adequately verify the identity of actors accessing protected resources. Specifically, the Langflow MCP (Model Context Protocol) SSE endpoint (/api/v1/mcp/sse) is exposed without requiring authentication, allowing any network-reachable attacker to establish a session, perform an MCP initialize handshake, and enumerate privileged server metadata and tool inventories via unauthenticated JSON-RPC requests. No privileges, user interaction, or special conditions are required — only network access to the Langflow HTTP service (default port 7860). A Metasploit auxiliary module and a public PoC are available demonstrating the attack flow (GitHub Advisory, Metasploit Module).

Successful exploitation allows an unauthenticated remote attacker to bypass all authentication controls, resulting in high impact to confidentiality, integrity, and availability of the affected Langflow OSS instance. An attacker can read and exfiltrate sensitive MCP configuration data, server metadata, and tool inventories; modify data or configurations; and potentially disrupt service availability. The unauthenticated MCP session obtained can also serve as an enabler for chained follow-on attacks against other Langflow-exposed MCP tools, increasing the risk of lateral movement within AI/ML pipeline environments (GitHub Advisory, IBM Advisory).

A functional Metasploit auxiliary module (langflow_auth_bypass_cve_2026_93680.rb) is publicly available in the Rapid7 Metasploit Framework, confirming weaponized exploit code exists (Metasploit Module). A separate Python PoC repository (rmhowe425/POC-CVE-2026-93680) also claims to demonstrate auth bypass and data exfiltration, though its contents could not be fully verified. The EPSS score is approximately 2.27% (83rd percentile), indicating elevated exploitation probability relative to most CVEs. NVD SSVC data classifies the vulnerability as automatable with total technical impact, though no confirmed in-the-wild exploitation or CISA KEV listing has been reported as of the time of publication (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Langflow OSS instances (versions 1.0.0–1.12.8) using tools like Shodan or Censys, targeting the default HTTP port 7860.
2. Connect to unauthenticated MCP SSE endpoint: Send an unauthenticated HTTP GET request to {TARGET}/api/v1/mcp/sse with the header Accept: text/event-stream. No credentials are required.
3. Extract MCP session ID: Parse the SSE stream response using a regex to extract the session ID from the endpoint path (e.g., /api/v1/mcp/?session_id=<id>).
4. Perform MCP initialize handshake: Send an unauthenticated HTTP POST to {TARGET}/api/v1/mcp/?session_id=<id> with a JSON-RPC initialize payload (specifying protocolVersion: 2025-06-18 and arbitrary clientInfo), then send a notifications/initialized notification.
5. Enumerate MCP tools: Send a JSON-RPC tools/list POST request using the same session ID; parse tool names, descriptions, and server metadata from the SSE response stream.
6. Exfiltrate and chain: Store collected server metadata, capabilities, and tool inventory for reconnaissance. Use the unauthenticated MCP session to plan or execute follow-on attacks against exposed MCP tools or other Langflow vulnerabilities (Metasploit Module).

• Network: Unauthenticated HTTP GET requests to /api/v1/mcp/sse with Accept: text/event-stream header from external or unexpected IP addresses; unauthenticated HTTP POST requests to /api/v1/mcp/?session_id=<id> without valid authentication tokens; unusual outbound connections from the Langflow server to unknown hosts.
• Logs: Langflow access logs showing repeated unauthenticated requests to /api/v1/mcp/sse and /api/v1/mcp/ endpoints; JSON-RPC method calls (initialize, notifications/initialized, tools/list) in request bodies without corresponding authenticated sessions; high volume of SSE connection attempts from a single source IP.
• File System: Unexpected JSON loot files (e.g., mcp_info.json) created in attacker-controlled locations if post-exploitation tools are used; new or modified configuration files in the Langflow installation directory.
• Process: Unusual child processes spawned by the Langflow service process; unexpected network listeners or outbound connections initiated by the Langflow application (Metasploit Module).

IBM recommends upgrading IBM Langflow OSS to version 1.12.9 or later (1.13.0 or beyond) to remediate this vulnerability (IBM Advisory, GitHub Advisory). As an interim workaround, implement network-level access controls (firewalls, VPNs, or IP allowlists) to restrict access to Langflow instances, particularly port 7860, to trusted networks only. Consider temporarily disabling public access to the Langflow service until patching is complete, and monitor for unauthorized access attempts to the /api/v1/mcp/sse endpoint.

Rapid7 highlighted the vulnerability in a Metasploit wrap-up blog post covering the new auxiliary module for CVE-2026-93680 (Rapid7 Blog). The Belgium Centre for Cybersecurity (CCB) issued an advisory warning of multiple vulnerabilities affecting IBM Langflow and urging immediate patching (CCB Advisory). Security researchers at Ostorlab published a technical write-up on the auto-login authentication bypass mechanism (Ostorlab Blog). Brandefense and other threat intelligence outlets covered the broader batch of critical Langflow vulnerabilities fixed in version 1.13.0, noting the severity of the authentication bypass (Brandefense).