What is the CVSS score of CVE-2026-12940?

CVE-2026-12940 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Langflow OSS are affected by CVE-2026-12940?

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a critical vulnerability (CVE-2026-12940) enabling unauthenticated attackers to execute arbitrary commands and gain complete control of affected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12940?

Yes, a public proof-of-concept exploit is available for CVE-2026-12940. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-12940?

Within 24 hours, identify and document all systems running IBM Langflow OSS, determine current versions, and restrict network access to vulnerable instances where possible pending patching. Within 7 days, apply the vendor-released patch to upgrade all affected systems to the latest available version released by IBM. Within 30 days, verify patch deployment across production, staging, and development environments through automated scanning or manual confirmation, and document remediation completion.

Langflow OSS CVE-2026-12940

EUVD-2026-51240 CRITICAL

OS Command Injection (CWE-78)

2026-07-30 ibm

GHSA-gx45-8jc3-gqqr

IBM Command Injection RCE Langflow Oss

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description confirms unauthenticated remote RCE via env-var injection, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact from arbitrary command execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:23 vuln.today

CVE Published

Jul 30, 2026 - 16:41 nvd

CRITICAL 9.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.

AnalysisAI

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed Langflow MCP endpoint

Delivery

Inject PS4/SHELLOPTS/BASHOPTS env vars

Exploit

Trigger MCP stdio subprocess launch

Execution

Bash xtrace expands malicious PS4

Impact

Execute arbitrary OS commands on host

Access

Reach exposed Langflow MCP endpoint

Delivery

Inject PS4/SHELLOPTS/BASHOPTS env vars

Exploit

Trigger MCP stdio subprocess launch

Execution

Bash xtrace expands malicious PS4

Impact

Execute arbitrary OS commands on host

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target Langflow OSS instance (1.0.0-1.10.1) use the MCP stdio launcher to spawn an external MCP server subprocess, and that an attacker can influence the environment variables passed to that launch-specifically injecting SHELLOPTS, BASHOPTS, and/or PS4, which the DANGEROUS_ENV_VARS blocklist does not filter. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are largely consistent and point to a genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a Langflow OSS instance and influence an MCP stdio server launch supplies malicious PS4 and SHELLOPTS/BASHOPTS environment values that the launcher passes to a Bash subprocess. When Bash runs with xtrace enabled, it expands the attacker-controlled PS4 trace prompt, executing the embedded command substitution and yielding arbitrary OS command execution on the host. …
Remediation	Upgrade to the fixed IBM Langflow OSS release identified in the vendor advisory at https://www.ibm.com/support/pages/node/7279995 (patch available per vendor advisory; an exact fixed version number is not specified in the provided data and must be taken from that page). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and document all systems running IBM Langflow OSS, determine current versions, and restrict network access to vulnerable instances where possible pending patching. …

Threat intelligence, references, and detailed analysis are available after sign-in.