CVE-2026-81941

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

View on CVE.org

Published Sep 10, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.

Analysis

Technical impact

An authenticated non‑administrative user can construct a flow that includes an MCP Tools component configured with a local stdio subprocess transport, bypassing the Langflow server‑side controls designed to restrain such execution. This flaw gives the attacker the ability to run arbitrary operating system commands at the privileges of the application process, exposing sensitive data such as environment credentials, modifying the file system, and enabling lateral movement to other services on the host.

Affected Systems

IBM Langflow OSS, versions 1.0.0 through 1.11.5 are vulnerable. The patched release is 1.11.6.

Risk and Exploitability

The CVSS score of 8.8 classifies this vulnerability as high severity. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication as a non‑administrative user, so the attack vector is internal. Once authenticated, the attacker can execute arbitrary commands on the host, compromising integrity and availability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

Langflow OSS

affected

Version	Status	Constraints
`1.0.0`	affected	≤ 1.11.5

Configuration 1 [-]

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Ibm

Langflow Oss

Version	Status	Scheme	Platform
`[1.0.0,1.11.5]`	affected	semver	—

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.11.6 https://pypi.org/project/langflow/

OpenCVE Recommended Actions

Apply the IBM‑released Langflow OSS 1.11.6 or later, available via PyPI to replace the vulnerable version.
If a patch cannot be applied immediately, reconfigure the application so that only administrators can create flows containing the MCP Tools component or disable that component entirely in the configuration.
Run the Langflow service under a minimal‑privilege system account to limit the potential impact of any successful exploitation.

Generated by OpenCVE AI on September 11, 2026 at 04:27 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.626% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.ibm.com/support/pages/node/7286666

History

Sep 16, 2026 1:15 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Langflow Langflow langflow
CPEs		cpe:2.3:a:langflow:langflow::::::::
Vendors & Products		Langflow Langflow langflow

Sep 12, 2026 12:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 10, 2026 9:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
Title		Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
First Time appeared		Ibm Ibm langflow Oss
Weaknesses		CWE-284
CPEs		cpe:2.3:a:ibm:langflow_oss:1.0.0:::::::* cpe:2.3:a:ibm:langflow_oss:1.11.5:::::::*
Vendors & Products		Ibm Ibm langflow Oss
References		https://www.ibm.com/support/pages/node/7286666
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`