What is the CVSS score of CVE-2026-17626?

CVE-2026-17626 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Langflow OSS are affected by CVE-2026-17626?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a critical vulnerability enabling any authenticated user to read and write arbitrary files on the host system.. A patch is available.

How to fix or mitigate CVE-2026-17626?

Within 24 hours, inventory all systems running Langflow versions 1.0.0 through 1.10.3 and restrict external network access; review authentication logs for suspicious activity and unauthorized file operations. Within 7 days, apply the vendor-released patch by upgrading to versions beyond 1.10.3, testing thoroughly in staging environments before production deployment. Within 30 days, conduct a security audit of vulnerable systems for unauthorized file access, implement principle-of-least-privilege controls in container configurations, and deploy runtime security monitoring for container processes.

Langflow OSS CVE-2026-17626

EUVD-2026-53473 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-05 ibm

GHSA-f93f-mcp7-xm47

Information Disclosure Docker IBM Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Scope is Changed because exploitation escapes the Langflow container to impact the Docker host; no host availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:33 vuln.today

CVE Published

Aug 05, 2026 - 16:31 nvd

HIGH 8.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.

Articles & Coverage 1

News 3 New Docker Vulnerabilities - 1 Critical, 2 High Severity Aug 06, 2026

AnalysisAI

Host filesystem read and write access in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated low-privilege user via insufficient filtering of Docker volume-mount and device-mapping arguments passed to Docker-based MCP servers. By injecting unsanitized flags such as --volume into MCP server configuration, an attacker can bind-mount arbitrary host directories into a spawned container, exposing or tampering with sensitive files outside the intended Docker isolation boundary. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-exploitable, low-complexity attack path and full CIA impact score (CVSS 8.8) make this a high-priority patch target for any organization running Langflow in Docker environments with externally accessible or multi-tenant access.

Technical ContextAI

IBM Langflow OSS is an open-source visual workflow builder for LLM applications built on top of LangChain. It incorporates support for Docker-based MCP (Model Context Protocol) servers - Anthropic's open protocol for connecting AI models to external tools - by dynamically constructing and executing docker run commands. The root cause is CWE-266 (Incorrect Privilege Assignment): Langflow's input sanitization fails to strip or reject dangerous Docker CLI flags such as -v/--volume and --device from user-supplied MCP server arguments. This allows authenticated users to define volume mounts that bind arbitrary host filesystem paths (e.g., /etc, /root, /var/run/docker.sock) into the MCP container at runtime. The affected CPE is cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, spanning all releases from 1.0.0 to 1.10.3. The vulnerability is a logical filtering bypass rather than a memory-safety or protocol flaw.

RemediationAI

Patch available per vendor advisory from IBM at https://www.ibm.com/support/pages/node/7282147. The exact patched release version is not specified in the available data and must be confirmed directly from the IBM support page before deployment - do not assume the latest available version is patched without verification. As an interim compensating control pending patching, restrict which authenticated users can create or modify Docker-based MCP server definitions by enforcing role-based access controls within Langflow's administration interface, limiting this capability to trusted administrators only. Additionally, apply Docker daemon-level hardening: configure a seccomp profile that denies the mount syscall, enable user namespace remapping to prevent root-equivalent host access from containers, and consider running the Docker socket with read-only permissions or behind an authorization plugin (e.g., OPA/Gatekeeper) that blocks volume mounts to sensitive host paths. Note that restricting network access to the Langflow web interface alone is insufficient mitigation, as any authenticated internal user with MCP server creation rights remains a viable threat actor.