Skip to main content

IBM Langflow OSS CVE-2026-9077

| EUVDEUVD-2026-53463 HIGH
Reliance on Untrusted Inputs in a Security Decision (CWE-807)
2026-08-05 ibm GHSA-wq3q-gcx9-xvm2
IBM Authentication Bypass Langflow Oss
8.5
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
8.5 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
vuln.today AI
8.5 HIGH

Low-privilege network-accessible auth bypass writing arbitrary configs to a subsequent host system justifies AV:N, PR:L, S:C, and I:H with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 05, 2026 - 17:21 vuln.today
CVE Published
Aug 05, 2026 - 16:24 cve.org
HIGH 8.5

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

AnalysisAI

Remote authenticated attackers can bypass localhost-only access restrictions in IBM Langflow OSS 1.0.0 through 1.10.3 to write arbitrary MCP (Model Context Protocol) server configurations to IDE configuration files on the underlying host system. The CVSS scope change (S:C) confirms this escapes the Langflow application boundary, enabling persistent manipulation of developer IDE environments on the host. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to Langflow with low-privilege credentials
Delivery
Craft MCP config API request with manipulated origin parameter
Exploit
Bypass localhost-only restriction via CWE-807 untrusted input check
Execution
Write attacker-controlled MCP server entry to host IDE config files
Impact
Rogue MCP server loads in developer IDE on next launch
Sign in to reveal

Vulnerability AssessmentAI

Exploitation A valid low-privilege authenticated account on the Langflow instance is required (CVSS PR:L confirms this). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.5 score is driven primarily by the scope change (S:C) and high integrity impact (I:H) on the subsequent system - the host IDE configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated attacker holding a low-privilege Langflow account sends a crafted API request to the MCP server configuration endpoint, supplying a manipulated origin or host parameter that bypasses the localhost-only restriction check. The application writes an attacker-specified MCP server definition - pointing to an attacker-controlled endpoint - into IDE configuration files on the host system. …
Remediation A patch is confirmed available from IBM per the vendor advisory at https://www.ibm.com/support/pages/node/7282147; the exact patched release version is not specified in available intelligence data and must be confirmed directly from the IBM advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running Langflow in versions 1.0.0 through 1.10.3 and restrict access to affected instances. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Langflow Oss

View all
CVE-2026-9198 CRITICAL POC
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
CVE-2026-10561 CRITICAL
10.0 Jun 22

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
CVE-2026-9135 CRITICAL
9.9 Jul 17

Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
CVE-2026-8476 CRITICAL
9.9 Jul 17

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
CVE-2026-8481 CRITICAL
9.9 Jul 17

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
CVE-2026-8859 CRITICAL
9.9 Jul 17

Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
CVE-2026-12946 CRITICAL
9.9 Jul 30

Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
CVE-2026-13435 CRITICAL
9.9 Jul 30

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
CVE-2026-8635 CRITICAL
9.9 Jul 17

Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
CVE-2026-7873 CRITICAL
9.9 Jun 30

Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
CVE-2026-8505 CRITICAL
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication

CVE-2026-12940 CRITICAL POC
9.8 Jul 30

Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary

Same weakness CWE-807 – Reliance on Untrusted Inputs in a Security Decision

View all
CVE-2026-21509 HIGH POC
7.8
CVE-2026-21514 HIGH
7.8
CVE-2026-64827 CRITICAL POC
9.3
CVE-2025-13926 CRITICAL
9.3
CVE-2019-25711 MEDIUM POC
6.9
CVE-2019-25594 MEDIUM POC
6.9
CVE-2019-25544 MEDIUM POC
6.9
CVE-2026-23848 MEDIUM POC
6.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-9077 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy