IBM Langflow CVE-2026-85025

Requires the target Langflow instance (OSS 1.0.0-1.11.5) to have a project publicly shared via an MCP project endpoint that is reachable over the network - that shared-endpoint configuration is the concrete precondition. Given that condition, no authentication and no user interaction are needed (PR:N/UI:N). The limiting factor is that instances with no publicly shared MCP endpoints, or that are not network-reachable by the attacker, are not exposed; the flaw is not triggerable against a default install that never enabled public MCP sharing.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, unauthenticated, no-interaction path to full confidentiality/integrity/availability impact, which is a genuine top-priority profile for any exposed instance. The important qualifier the raw score hides is that exploitation depends on a project being publicly shared through an MCP endpoint - this is a supported Langflow feature but not universally enabled, so real-world exposure is a subset of deployments rather than every default install. No EPSS score, KEV listing, or POC reference was provided, so there is no evidence of active exploitation or public exploit code at this time; the priority derives from severity and product popularity, not from observed in-the-wild activity. Given Langflow instances are frequently stood up on internet-facing dev/prototype infrastructure, treat internet-exposed instances as high urgency and internal-only instances as high-but-contained.

An attacker discovers an internet-reachable Langflow instance that has a project shared publicly through an MCP endpoint, then sends requests to that endpoint that the broken authorization checks fail to reject. The requests execute code within the flow and let the attacker read or alter other users' chat sessions. No authentication or user interaction is required, matching the AV:N/PR:N/UI:N vector; no public POC was provided.