The report
A Langflow 1.13.0 security bulletin contains three materially different application failures. One advisory describes a remote code-execution path through MCP tool enumeration. Another concerns a low-privilege authenticated user's ability to get the Agentic Assistant to submit unsafe generated Python code. A third addresses incomplete authentication protection associated with auto-login settings.
| Condition | Distinguishing prerequisite | Corresponding advisory |
|---|---|---|
| MCP tool enumeration leads to code execution | An affected externally reachable tool-enumeration path | CVE-2026-110186 |
| Generated Python component escapes restrictions | A low-privilege authenticated user and the relevant Agentic Assistant execution route | CVE-2026-110193 |
| Auto-login behavior weakens authentication | Relevant deployment configuration, including explicit overrides | CVE-2026-93680 |
The IBM bulletin supports the three disclosures, but not the claim that all vulnerabilities share the same executable sink. Langflow 1.13.0 changes the default auto-login posture; administrators who explicitly preserve LANGFLOW_AUTO_LOGIN=true must inspect their effective settings rather than assuming that a package upgrade disables a configuration they chose.
These conditions are tracked in separate tool-enumeration, generated-code and authentication-default dossiers. The useful acceptance test is not simply a version number: verify unauthenticated MCP requests are rejected, generated components lack unintended host execution rights, and upgraded instances enforce the intended login policy.