Security Bulletin
Summary
Langflow uses a code security scanner and component-level execution policies to restrict server-side code execution to authorized users and contexts. The agentic assistant code scanner employs an incomplete denylist omitting process-spawning primitives and contains a logic error where annotated class-body assignments bypass the safety check; the lfx CodeParser additionally passes return-type annotation source directly to eval without sanitization. The deprecated flow vertices build endpoint accepts attacker-supplied flow data and executes component code without the owner-only gate or component policy validation applied to sibling build paths. The MCP stdio validator on Windows recognizes only one cmd.exe execution switch, allowing alternate switches to bypass the command allow-list, and the OPENSSL_CONF environment variable is absent from the MCP stdio environment-variable blocklist, permitting native code execution via OpenSSL engine loading. The custom component admin-only policy is enforced on the direct custom-component endpoint but not on ordinary flow create and stored-flow build paths, allowing any authenticated user to persist and execute attacker-controlled component source. The MCP Tools stdio component bypasses all code-execution restriction settings when invoked through a flow, and publicly shared MCP project transports and public flows containing MCP Tools components do not apply the public-flow code-execution guard or session namespace scoping enforced on all other anonymous execution surfaces, permitting unauthenticated code execution and session tampering.
Vulnerability Details
CVEID: CVE-2026-79724
DESCRIPTION: Langflow OSS could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS Source: IBM
CVSS Base score: 9.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-85025
DESCRIPTION: Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.
CWE: CWE-863: Incorrect Authorization
CVSS Source: IBM
CVSS Base score: 9.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-81941
DESCRIPTION: Langflow OSS allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
CWE: CWE-284: Improper Access Control
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-81204
DESCRIPTION: Langflow OSS could allow a remote attacker to execute arbitrary code due to code injection during graph construction.
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS Source: IBM
CVSS Base score: 9.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-81211
DESCRIPTION: Langflow OSS could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.
CWE: CWE-862: Missing Authorization
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-81940
DESCRIPTION: Langflow OSS could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-78569
DESCRIPTION: Langflow OSS could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-78575
DESCRIPTION: Langflow OSS could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-76059
DESCRIPTION: An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.
CWE: CWE-693: Protection Mechanism Failure
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-79742
DESCRIPTION: Langflow OSS could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-78571
DESCRIPTION: Langflow OSS could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| Langflow OSS | 1.0.0-1.11.5 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.11.6
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
Change History
08 Sep 2026: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
08 September 2026
Initial Publish date:
08 September 2026
UID
ibm17286666