What is the CVSS score of CVE-2026-17623?

CVE-2026-17623 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Langflow OSS are affected by CVE-2026-17623?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a command-execution vulnerability exploitable by authenticated users; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-17623?

Within 24 hours, conduct an audit of all Langflow deployments to identify which systems run versions 1.0.0 through 1.10.3 and document all user accounts with access to MCP server configuration features. Within 7 days, obtain and deploy the latest patched version of IBM Langflow from the vendor, testing in non-production environments first, then roll out to all production systems. Within 30 days, verify all systems are patched, review MCP configuration modification logs for suspicious activity during the vulnerable period, and implement access controls limiting low-privilege user access to Langflow configuration.

Langflow OSS CVE-2026-17623

EUVD-2026-53478 HIGH

OS Command Injection (CWE-78)

2026-08-05 ibm

GHSA-7rx7-4wfr-4qqv

Command Injection IBM Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable endpoint, low complexity; PR:L required because MCP configuration access demands an authenticated session with at least standard user privileges.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:33 vuln.today

CVE Published

Aug 05, 2026 - 16:34 nvd

HIGH 8.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations.

AnalysisAI

Arbitrary OS command execution in IBM Langflow OSS 1.0.0 through 1.10.3 is reachable by any authenticated low-privileged user who can modify MCP server configurations. Improper validation of the command field in those configurations allows injected shell commands to be executed with the application's process privileges, yielding full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path against a growing AI-tooling platform warrants prompt patching.

Technical ContextAI

IBM Langflow OSS is a visual, open-source AI workflow builder that lets users compose LLM pipelines and integrate external tools. The Model Context Protocol (MCP) server configuration feature allows users to define external tool integrations by specifying executable commands. CWE-78 (Improper Neutralization of Special Elements Used in an OS Command) identifies the root cause: user-supplied input in the 'command' configuration field is passed to a system shell or process-spawning API without adequate sanitization or allowlisting, enabling classic OS command injection via shell metacharacters. The affected CPE is cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, spanning the full release history from 1.0.0 to 1.10.3.

RemediationAI

Apply the vendor-released patch referenced in the IBM advisory at https://www.ibm.com/support/pages/node/7282147; a patch is confirmed available from the vendor, though the exact fixed version number is not specified in the currently available intelligence and must be confirmed directly from that advisory before upgrading. As an immediate compensating control, restrict access to the MCP server configuration interface to the smallest possible set of trusted administrative users, enforcing the principle of least privilege through role-based access controls within Langflow; note that this reduces attack surface but does not eliminate it if administrators are compromised. Additionally, audit all existing MCP server configuration entries for suspicious or unexpected command field values, and consider deploying network-level controls that limit outbound connections from the Langflow host to prevent exfiltration or reverse-shell establishment in the event of a compromise.