IBM Langflow OSS 1.0.0

Published September 10, 2026 CVE-2026-78575

IBM Langflow OSS has a flaw that lets a logged-in remote user run commands on the Langflow server. That could expose data, change files, or disrupt the service.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 1.11.6
Affected versions
1.0.0 through 1.11.5
Weakness
CWE-78OS Command Injection
Exploit likelihood
0.51% in 30 daysEPSS, higher than 42% of known flaws
Affects
Langflow OSS
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75796ENISA vulnerability database

How it works

  • A remote user first needs a Langflow account.
  • They can provide command-line arguments through the MCP stdio server settings.
  • Langflow does not validate those arguments correctly, so it can execute attacker-chosen commands.

What to do

Run python3 -m pip show langflow and compare the reported version with 1.0.0 through 1.11.5. A matching version is affected.

Run this in the application environment you want to check:

python3 -m pip show langflow

Upgrade Langflow OSS to version 1.11.6 from PyPI, following the IBM advisory.

Technical details

CVE-2026-78575 is an OS command injection flaw in Langflow OSS's MCP stdio server configuration. IBM rates it 8.8 high because a remote authenticated user can execute commands without additional interaction.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source