Description
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations.
Published: 2026-08-05
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Langflow OSS 1.0.0–1.10.3 contains an OS command injection flaw in the Model Context Protocol (MCP) server configuration. Improper validation of the command field allows a remote authenticated attacker to inject and execute arbitrary shell commands on the host, giving full control of the operating system.

Affected Systems

IBM Langflow OSS versions 1.0.0 through 1.10.3 are affected by this vulnerability. All releases in that range, including the cpe entries for 1.0.0 and 1.10.3, are vulnerable.

Risk and Exploitability

With a CVSS score of 8.8 the flaw is high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The attack vector is remote but requires authentication to the MCP endpoint, so any user who can log in can trigger the exploit by submitting a crafted command via the legitimate API.

Generated by OpenCVE AI on August 5, 2026 at 18:36 UTC.

Remediation

Vendor Solution

IBM recommends upgrading to Langflow OSS 1.11.0 or newer https://github.com/langflow-ai/langflow/releases

OpenCVE Recommended Actions

  • Upgrade IBM Langflow OSS to version 1.11.0 or newer, removing the vulnerable command parsing logic.
  • Revoke or restrict authentication credentials for the MCP server to limit exposure to trusted users only.
  • Configure the application in a hardened environment and monitor for any unauthorized command execution attempts.

Generated by OpenCVE AI on August 5, 2026 at 18:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations.
Title Langflow is affected OS Command Injection in Model Context Protocol features
First Time appeared Ibm
Ibm langflow Oss
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:langflow_oss:1.10.3:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm langflow Oss
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Langflow Oss
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-05T18:11:04.716Z

Reserved: 2026-07-27T20:52:42.230Z

Link: CVE-2026-17623

cve-icon Vulnrichment

Updated: 2026-08-05T18:10:53.041Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T18:30:16Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')