Remote code execution in IBM Langflow OSS (CVE-2026-7755)

CVE-2026-7755 is a remote code execution vulnerability in IBM Langflow OSS affecting the MCP server configuration file handling. The file upload endpoint accepted MCP configuration files without invoking the MCPServerConfig validator, allowing an authenticated attacker to upload malicious configurations containing dangerous environment variables or command arguments. When MCP servers were enumerated, the malicious configuration could cause processes to be spawned with attacker-controlled inputs, potentially achieving remote code execution. Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 8.8 · our assessment: this_week Vendor advisory: https://www.ibm.com/support/pages/node/7278932 Details: https://vuln.today/cve/CVE-2026-7755