IBM Langflow OSS CVE-2026-81941

Exploitation requires a valid authenticated session as any non-administrative Langflow user (CVSS PR:L confirmed). The user must have permission to create or edit flows - this is standard, non-privileged core functionality in Langflow, not a separately gated capability. The MCP Tools component must be accessible in the component palette. Critically, two server-side enforcement flags that administrators may have enabled specifically to prevent this class of access - LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS - are both bypassed by the MCP Tools stdio transport path and do NOT limit exploitation. What limits exploitation: a valid account is required (no unauthenticated/anonymous path); the target must be IBM Langflow OSS 1.0.0-1.11.5; environments where flow creation is restricted exclusively to administrators eliminate the non-admin attack surface entirely.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the exploitation profile: network-reachable via the Langflow web interface, low complexity, requiring only a valid non-admin account, with full confidentiality, integrity, and availability impact on the server. No EPSS data was provided in the input and no KEV or POC status is confirmed. Despite the absence of public exploit code, the technique is conceptually straightforward - flow construction is core product functionality, and the bypass of two explicit security controls suggests the MCP Tools pathway was not included in the threat model during control implementation. Real-world risk is highest in multi-tenant or SaaS-style deployments where non-admin accounts belong to external or partially trusted users; single-operator instances where all authenticated users are already implicitly trusted present lower practical risk. The sensitivity of AI workflow servers - which routinely hold API keys, model credentials, and database connection strings in their process environment - elevates the consequence of any successful exploitation significantly.

An attacker holding a valid non-admin Langflow account - such as a developer, analyst, or external collaborator seat in a shared enterprise instance - opens the flow editor, adds an MCP Tools component, and configures its transport to a local stdio subprocess invoking a shell or script of their choice. When the flow is executed, the Langflow server spawns the subprocess under its own OS credentials, returning output to the flow and allowing the attacker to exfiltrate environment variables containing API keys, database passwords, or cloud IAM tokens, then pivot to internal services reachable from the server. No administrative privileges, special platform knowledge, or prior reconnaissance beyond basic Langflow usage is required.