CVE-2026-81941
HighCVSS 8.8Summary
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user to execute arbitrary OS commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access.
Risk Assessment
Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
Recommendation
Update Langflow OSS to a version newer than 1.11.5 as soon as it becomes available. Restrict access to flow creation and verify that no unauthorized command execution has occurred.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-84889High
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
- CVE-2026-81940High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names. The flaw enables code injection through the flow name field.
- CVE-2026-81268High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.
- CVE-2026-81265High
IBM Langflow OSS 1.0.0 through 1.11.5 — no vulnerability description was provided in the supplied source.
- CVE-2026-81213High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.
- CVE-2026-81211High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.
- CVE-2026-79742High
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an incomplete environment variable blocklist. A remote authenticated attacker could exploit this to execute arbitrary code.
- CVE-2026-79725Medium
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.
- CVE-2026-79723Medium
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.
- CVE-2026-78575High
IBM Langflow OSS versions 1.0.0 through 1.11.5 improperly validate command-line arguments in the MCP stdio server configuration. A remote authenticated attacker could execute arbitrary commands.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.