Another flaw, CVE-2026-110186, allows unauthenticated remote attackers to execute arbitrary code through Model Context Protocol (MCP) tool enumeration. A third vulnerability, CVE-2026-110193, which is rated as high severity, also allows for code and command execution on the server due to an issue in a third-party library used by the Agentic Assistant. However, exploiting this flaw requires authentication with at least a low-privileged account.
The fourth vulnerability, CVE-2026-110192, is an information disclosure issue due to insufficiently protected API credentials. It is rated as 6.5 on the CVSS scale.
The flaws affect Langflow OSS versions 1.0.0 to 1.12.8 and were fixed in the newly released 1.13.0 version, which is available both from the PyPI repository and as a Docker image.
