What is the CVSS score of CVE-2026-12940?

CVE-2026-12940 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Langflow OSS are affected by CVE-2026-12940?

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a critical vulnerability (CVE-2026-12940) enabling unauthenticated attackers to execute arbitrary commands and gain complete control of affected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12940?

Yes, a public proof-of-concept exploit is available for CVE-2026-12940. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-12940?

Within 24 hours, identify and document all systems running IBM Langflow OSS, determine current versions, and restrict network access to vulnerable instances where possible pending patching. Within 7 days, apply the vendor-released patch to upgrade all affected systems to the latest available version released by IBM. Within 30 days, verify patch deployment across production, staging, and development environments through automated scanning or manual confirmation, and document remediation completion.

Langflow OSS CVE-2026-12940

EUVD-2026-51240 CRITICAL

OS Command Injection (CWE-78)

2026-07-30 ibm

GHSA-gx45-8jc3-gqqr

RCE Command Injection IBM Langflow Oss

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description confirms unauthenticated remote RCE via env-var injection, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact from arbitrary command execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:23 vuln.today

CVE Published

Jul 30, 2026 - 16:41 nvd

CRITICAL 9.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.

AnalysisAI

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector; a vendor patch is available, but no public exploit code or CISA KEV listing has been identified at the time of analysis.

Technical ContextAI

Langflow OSS is an open-source, low-code Python platform for visually building LLM/agent workflows; this flaw lives in its MCP integration layer, which can launch external Model Context Protocol servers over stdio by spawning child processes with a caller-influenced environment. To reduce risk, the code maintains a DANGEROUS_ENV_VARS blocklist intended to strip variables that could alter subprocess behavior, but it fails to cover SHELLOPTS, BASHOPTS, and PS4. These are Bash-specific controls: SHELLOPTS/BASHOPTS can enable shell options such as xtrace (set -x) at startup, and PS4 defines the trace prompt string that Bash expands-including command substitutions-each time a traced command runs. Passing PS4 together with xtrace-enabling options into a Bash subprocess therefore causes attacker-supplied command substitution to execute, matching the CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection) root-cause class. The affected component is identified by CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to the fixed IBM Langflow OSS release identified in the vendor advisory at https://www.ibm.com/support/pages/node/7279995 (patch available per vendor advisory; an exact fixed version number is not specified in the provided data and must be taken from that page). Until patched, restrict who can reach and configure MCP integrations: avoid using stdio-based MCP servers, and if the platform is network-exposed, place it behind authentication and network controls so untrusted users cannot trigger MCP server launches. As a targeted compensating control, sanitize the subprocess environment for MCP stdio launches to explicitly strip SHELLOPTS, BASHOPTS, and PS4 in addition to the existing DANGEROUS_ENV_VARS entries, or force child processes to run with a minimal/allowlisted environment; note that over-stripping environment variables could break legitimate MCP servers that rely on specific env configuration, so validate integrations after applying. Where feasible, run MCP subprocesses under a non-Bash or hardened non-interactive shell configuration to neutralize PS4/xtrace abuse.