CVE-2026-9103: Langflow Authentication Bypass Vulnerability

CVE-2026-9103 Overview

CVE-2026-9103 is an authentication bypass vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw resides in the /api/v1/login/auto_login endpoint, which issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled. Because AUTO_LOGIN is enabled by default, an unauthenticated network attacker can obtain full administrative access to affected deployments. Permissive cross-origin resource sharing (CORS) settings compound the issue by allowing tokens to leak to unintended origins. The weakness is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated remote attackers can retrieve superuser bearer tokens and gain full administrative control of Langflow instances exposed on the network.

Affected Products

Langflow Langflow OSS versions 1.0.0 through 1.10.0
Deployments on Linux, macOS, and Microsoft Windows hosts
Any Langflow instance running the default AUTO_LOGIN=true configuration

Discovery Timeline

2026-07-17 - CVE-2026-9103 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-9103

Vulnerability Analysis

Langflow exposes an authentication convenience endpoint at /api/v1/login/auto_login. When the AUTO_LOGIN environment variable is enabled, this endpoint returns a valid bearer token for the built-in superuser account without validating any credentials. The token grants unrestricted access to Langflow administrative APIs, including flow management, workspace configuration, and code execution features that Langflow exposes to authenticated users.

The issue is amplified by the application's CORS policy. Permissive origin handling permits browsers running attacker-controlled JavaScript to call the endpoint and read the response. A victim visiting a malicious page while a Langflow instance is reachable can have the token exfiltrated to a third-party origin.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The auto_login route was designed for single-user local development but is enabled by default in production builds. No policy check gates the endpoint, and the returned tokens are long-lived, so exposure does not self-remediate through short expiry windows.

Attack Vector

Exploitation requires only network reachability to the Langflow HTTP API. An attacker sends an unauthenticated request to /api/v1/login/auto_login, parses the returned bearer token, and reuses it against any protected Langflow API. In browser-based attacks, the permissive CORS configuration allows cross-origin JavaScript to complete the same sequence and forward the token to an external collector.

No verified public exploit code is available at the time of publication. Refer to the IBM Support advisory for the vendor description of the attack path.

Detection Methods for CVE-2026-9103

Indicators of Compromise

HTTP requests to /api/v1/login/auto_login originating from external or unexpected source addresses.
Bearer tokens tied to the superuser account being used from IP addresses outside administrator ranges.
Creation of new flows, components, or scheduled jobs by the built-in superuser without a corresponding operator session.
Outbound requests from browsers to unfamiliar origins immediately after loading a Langflow session.

Detection Strategies

Alert on any successful HTTP 200 response from /api/v1/login/auto_login where the source IP is not an approved management host.
Review web server and reverse-proxy logs for repeated calls to the auto_login endpoint from a single client within a short window.
Correlate Langflow audit events showing superuser activity with authentication logs to identify tokens issued without an interactive login.

Monitoring Recommendations

Forward Langflow application logs and reverse-proxy access logs to a centralized log platform for retention and search.
Baseline normal administrative activity for the Langflow superuser account and flag deviations in geography, user agent, or working hours.
Monitor CORS preflight (OPTIONS) traffic to Langflow endpoints for origins outside the sanctioned allowlist.

How to Mitigate CVE-2026-9103

Immediate Actions Required

Set LANGFLOW_AUTO_LOGIN=false on every Langflow deployment and restart the service.
Restrict network exposure of Langflow to trusted management networks using firewall or reverse-proxy access controls.
Rotate any superuser credentials and invalidate outstanding bearer tokens issued while AUTO_LOGIN was enabled.
Upgrade to a Langflow release beyond 1.10.0 that addresses CVE-2026-9103 once available from the vendor.

Patch Information

Refer to the IBM Support page for CVE-2026-9103 for the current list of fixed versions, remediation guidance, and vendor-supplied configuration hardening steps. Apply the fixed release across all Langflow nodes, including development and staging environments that may be reachable from corporate networks.

Workarounds

Disable the AUTO_LOGIN configuration flag and require authenticated login for all users.
Configure a strict CORS allowlist that only permits origins your operators control.
Place Langflow behind an authenticating reverse proxy or VPN so that /api/v1/login/auto_login is not reachable without prior identity verification.
Terminate all active superuser sessions and rotate signing keys used to issue bearer tokens.

bash

# Configuration example: disable auto-login and enforce CORS allowlist
export LANGFLOW_AUTO_LOGIN=false
export LANGFLOW_SUPERUSER=admin
export LANGFLOW_SUPERUSER_PASSWORD='<set-a-strong-secret>'
export LANGFLOW_NEW_USER_IS_ACTIVE=false
export LANGFLOW_CORS_ORIGINS='https://langflow.internal.example.com'

# Restart the service after applying the environment changes
systemctl restart langflow