CVE-2026-78575
HighCVSS 8.8Summary
IBM Langflow OSS versions 1.0.0 through 1.11.5 improperly validate command-line arguments in the MCP stdio server configuration. A remote authenticated attacker could execute arbitrary commands.
Risk Assessment
An attacker with a valid account could run arbitrary system commands on the server, potentially leading to full host compromise. This may result in loss of data confidentiality and integrity.
Recommendation
Update IBM Langflow OSS to a version later than 1.11.5 once a fix is released. Restrict the ability to configure the MCP stdio server to trusted administrators only.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-84889High
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
- CVE-2026-81941High
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user to execute arbitrary OS commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access.
- CVE-2026-81940High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names. The flaw enables code injection through the flow name field.
- CVE-2026-81268High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.
- CVE-2026-81265High
IBM Langflow OSS 1.0.0 through 1.11.5 — no vulnerability description was provided in the supplied source.
- CVE-2026-81213High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.
- CVE-2026-81211High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.
- CVE-2026-79742High
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an incomplete environment variable blocklist. A remote authenticated attacker could exploit this to execute arbitrary code.
- CVE-2026-79725Medium
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.
- CVE-2026-79723Medium
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.