Technology
Langflow's default login left a 9.8-rated door open until 1.13.0
IBM's bulletin covers four Langflow flaws in every release from 1.0.0 through 1.12.8, two of them rated 9.8: an authentication bypass tracked as CVE-2026-93680 and unauthenticated code execution through code generation, CVE-2026-110186. Automatic login, which signs users in as superusers, is enabled by default in 1.12.8 and disabled in 1.13.0. IBM lists no workaround, and a public Metasploit module already enumerates tools on unpatched MCP endpoints.