CVE-2026-110186 is an unauthenticated remote-code-execution issue in Langflow OSS, the open-source visual environment for building AI applications and workflows. IBM describes the specific path as Model Context Protocol (MCP) tool enumeration: a feature used to discover tools exposed to an AI client. In the affected implementation, improper control of code generation lets a remote attacker turn that interaction into arbitrary code execution.
That is a materially different risk from a developer intentionally running Python in Langflow. The product is designed as an IDE and execution platform for AI flows, so trusted authors may connect models, prompts, data stores, agents and tools, then test or serve those flows. Here, though, IBM assigns CVE-2026-110186 a 9.8 CVSS score and says neither credentials nor user interaction are required. An attacker needs network reachability to a vulnerable deployment, not an account or a foothold inside the application.
MCP discovery becomes an execution path
The advisory does not identify the vulnerable function, publish a CVE-specific patch diff, or explain exactly how the generated code crosses into execution. That leaves an important operational boundary clear even if the implementation detail is not: code execution would occur in the context of the Langflow backend process. Depending on how an operator deployed it, that can mean access to the process's files, secrets, network routes and permissions.
Langflow's normal audience makes this worth taking seriously. Application engineering, AI/ML, data and platform teams use it to prototype and self-host chatbots, document-analysis and retrieval-augmented-generation systems, customer-service automation, and agentic workflows. It can run from a Python package or Docker image, on remote servers and in Kubernetes; the exposed population therefore includes companies building internal AI services as well as organisations serving flows to other users. Multi-tenant environments deserve particular scrutiny because infrastructure isolation, rather than the visual editor alone, separates workloads.
Upgrade the service, not just its access controls
IBM's bulletin says Langflow OSS 1.0.0 through 1.12.8 are affected and directs administrators to upgrade to 1.13.0. Before changing a production instance, back up the database, secret key and uploaded files as IBM instructs. Python installations should use pip install --upgrade "langflow==1.13.0"; Docker users should deploy langflowai/langflow:1.13.0. The advisory specifies no interim workaround, so restricting public exposure can reduce immediate reachability but is not a substitute for the upgrade.
This release also addresses an authentication bypass, alongside issues including CVE-2026-93680. Treat that companion bypass as a reason to review who can reach the UI, APIs and MCP-facing services after patching: an authentication layer cannot be assumed to compensate for an unpatched code-execution path, and the code-execution fix does not remove the need to apply the other fixes in the release.
No confirmed attacks or public exploit
As of October 31, 2026, there is no confirmed evidence of exploitation in the wild, and CVE-2026-110186 is not in CISA's Known Exploited Vulnerabilities catalogue; the CVE record records exploitation as none. No public proof of concept has surfaced either: checks of common exploit repositories did not substantiate CVE-specific code, despite one unsupported roundup claim. Older Langflow exploits should not be treated as exploits for this flaw.
Inventory self-managed Langflow now, especially internet-reachable instances, upgrade to 1.13.0, and verify the running image or package version rather than assuming a rebuild picked it up. SecAlerts monitors an organisation's actual software stack and alerts on new vulnerabilities affecting the products it runs, which is useful when a single release fixes both a no-login execution path and an authentication control failure.
