CVE-2026-9077
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
IBM Langflow OSS 1.0.0 through 1.10.3 allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.
Risk Assessment
This vulnerability may allow an attacker to modify IDE configurations, potentially leading to arbitrary code execution or system integrity compromise.
Recommendation
It is recommended to update IBM Langflow OSS to a version newer than 1.10.3 and restrict access to configuration endpoints.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-19295Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 allow an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allows privilege escalation from 'authenticated flow user' to arbitrary OS-level command execution, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy.
- CVE-2026-19286Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
- CVE-2026-19297Critical
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
- CVE-2026-12946Critical
IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.
- CVE-2026-13435Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation vulnerability in the PythonREPL sandbox implementation.
- CVE-2026-12940Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP stdio launcher. The vulnerability is due to an incomplete blocklist of dangerous environment variables (missing SHELLOPTS, BASHOPTS, and PS4) in src/lfx/src/lfx/base/mcp/util.py.
- CVE-2026-13446Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication, or internal data encryption.
- CVE-2026-8635Critical
IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
- CVE-2026-8505Critical
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in webhook authentication logic that allows unauthenticated users to trigger execution of any flow when WEBHOOK_AUTH_ENABLE is set to False (default).
- CVE-2026-8481Critical
Critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 in the /api/v1/validate/code endpoint. Allows an authenticated attacker to execute arbitrary Python code on the server without sandboxing, leading to remote code execution.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.