Description
IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.
Published: 2026-07-30
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows an attacker to inject dangerous environment variables into the MCP (Model Context Protocol) stdio launcher of IBM Langflow OSS. Because the blocklist for protected environment variables does not include SHELLOPTS, BASHOPTS, or PS4, the application can execute arbitrary shell commands. The flaw is a classic command injection (CWE-78 style) and can lead to the host system running the application being fully compromised.

Affected Systems

IBM Langflow OSS releases 1.0.0 through 1.10.1 are affected. This includes the versions listed by the vendor and any derivative deployments that have not applied the vendor‑provided patch.

Risk and Exploitability

The CVSS score of 9.8 marks this flaw as critical. The EPSS score indicates a very low exploitation probability (<1%). The flaw is fully exploitable unauthenticated through exposed API endpoints. The vulnerability is not yet listed in CISA’s KEV catalog. An attacker who can reach the MCP stdio launcher, for example through the web or network, can trigger arbitrary code execution with the privileges of the Langflow process.

Generated by OpenCVE AI on August 2, 2026 at 05:08 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.2 https://pypi.org/project/langflow/

OpenCVE Recommended Actions

  • Upgrade IBM Langflow OSS to version 1.10.2 or later as recommended by IBM.
  • Configure network or application firewall rules to restrict unauthenticated access to the MCP stdio launcher endpoints.
  • Review the deployment’s environment variable handling and ensure that SHELLOPTS, BASHOPTS, and PS4 are blocked from being set by external requests.

Generated by OpenCVE AI on August 2, 2026 at 05:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Description IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.
Title Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints
First Time appeared Ibm
Ibm langflow Oss
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:langflow_oss:1.10.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm langflow Oss
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Langflow Oss
Langflow Langflow
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-31T03:56:16.617Z

Reserved: 2026-06-22T19:44:45.455Z

Link: CVE-2026-12940

cve-icon Vulnrichment

Updated: 2026-07-30T18:05:14.631Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T17:16:28.040

Modified: 2026-08-04T20:20:28.103

Link: CVE-2026-12940

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T05:15:15Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')