What is the CVSS score of EUVD-2026-45285?

EUVD-2026-45285 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow are affected by EUVD-2026-45285?

A critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows any low-privileged application user to execute arbitrary code on the host system, enabling rapid escalation to…. A patch is available.

How to fix or mitigate EUVD-2026-45285?

Within 24 hours, inventory all IBM Langflow OSS instances across production and non-production environments, confirm current versions, and verify patch availability from IBM advisory node/7278932. Within 7 days, deploy the vendor-released patch to all Langflow instances, testing first in non-production to confirm operational compatibility before proceeding to production systems. Within 30 days, verify complete deployment across all systems, confirm removal of vulnerable versions, and document remediation closure.

IBM Langflow EUVD-2026-45285

| CVE-2026-7755 HIGH

Improper Input Validation (CWE-20)

2026-07-17 ibm

GHSA-m94m-8f9x-f6r4

RCE IBM Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable config feature exploitable by any low-privileged authenticated user (PR:L), no user interaction, yielding full host code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:48 vuln.today

CVE Published

Jul 17, 2026 - 19:18 cve.org

HIGH 8.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.

AnalysisAI

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated remote attacker to run arbitrary code because validation is not fully enforced on Model Context Protocol (MCP) server configuration files, permitting injection of attacker-controlled commands or server definitions. IBM has published a fix advisory (node/7278932). With CVSS 8.8 (PR:L), a low-privileged user of the Langflow instance can escalate to full code execution on the host; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Langflow is an open-source, Python-based low-code framework for building LLM-driven agents and RAG pipelines, now maintained under IBM. It integrates the Model Context Protocol (MCP), a standard that lets the platform launch and connect to external 'MCP servers' - typically local processes started from a configuration file that specifies a command, arguments, and environment. The flaw is an incomplete validation enforcement (an input-validation/command-injection class weakness; NVD lists CWE as N/A) on these MCP server configuration files: because the configuration that defines which executables/commands are spawned is not fully validated, an attacker who can influence that configuration can cause Langflow to execute arbitrary commands. The single affected CPE is cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, scoped to the 1.0.0-1.10.0 version band.

RemediationAI

Patch available per vendor advisory - apply the update referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7278932; the exact fixed version was not included in the provided data, so obtain it directly from that advisory (the affected band ends at 1.10.0, so upgrade to the first release IBM identifies as fixed). Until patched, restrict who can reach and authenticate to the Langflow instance: place it behind a reverse proxy with strong authentication and network ACLs so only trusted operators can access the UI/API, since exploitation requires an authenticated (PR:L) user. Additionally, lock down and monitor the MCP server configuration files and any endpoints that create or edit MCP server definitions, remove or restrict the ability of non-admin users to add MCP servers, and run Langflow as an unprivileged, sandboxed/containerized service so that any code execution is confined - noting the trade-off that disabling MCP server management will break legitimate agent integrations that rely on external MCP tools.