CVE-2026-93680 is a critical (CVSS 9.8) improper authentication flaw in IBM Langflow OSS 1.0.0 through 1.12.8 that could let a remote, unauthenticated attacker bypass security restrictions.
What Is It
IBM's PSIRT reports that IBM Langflow OSS versions 1.0.0 through 1.12.8 "could allow a remote attacker to bypass security restrictions due to improper authentication." The weakness is classified as CWE-287 (Improper Authentication).
NVD published the record on 2026-10-29, and its status is currently "Undergoing Analysis." The NVD entry gives no further technical detail on the root cause or the affected component.
Why It Matters
IBM's CVSS v3.1 score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector means:
- Attack vector: Network. The flaw can be exploited remotely.
- Attack complexity: Low.
- Privileges required: None. The attacker does not need an account.
- User interaction: None.
- Impact: High for confidentiality, integrity, and availability.
Put simply, an attacker who can reach a vulnerable instance over the network could get past its authentication controls without credentials or any help from a user. The scoring rates the possible impact on the system as complete. Exploitability subscore: 3.9. Impact subscore: 5.9.
Exploitation status: CVE-2026-93680 does not appear in CISA's Known Exploited Vulnerabilities catalog. CISA has not confirmed active exploitation, and there is no CISA-mandated remediation deadline at this time.
What's Vulnerable
- Vendor: IBM
- Product: Langflow OSS
- Affected versions: 1.0.0 through 1.12.8 inclusive (semver)
- CPEs listed:
cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:langflow_oss:1.12.8:*:*:*:*:*:*:*
If you run any Langflow OSS release in that range, treat it as affected. This matters most if the instance can be reached from untrusted networks.
Patch Status
The NVD record does not name a fixed version. IBM's PSIRT links to an IBM support advisory (node 7294467), which is the authoritative place to check for fixed releases and remediation guidance.
There is no KEV entry, so no CISA required action or due date applies at this time.
Recommended steps:
- Review the IBM advisory and apply any fixed release or mitigation it provides.
- Inventory Langflow OSS deployments running versions 1.0.0–1.12.8.
- Prioritize instances that can be reached from the network, given the unauthenticated, low-complexity attack profile.
Sources
- NVD, CVE-2026-93680
- IBM Support Advisory (node 7294467)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)