EUVD-2026-53473
GHSA-f93f-mcp7-xm47
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Scope is Changed because exploitation escapes the Langflow container to impact the Docker host; no host availability impact is described.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.
Articles & Coverage 1
AnalysisAI
Host filesystem read and write access in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated low-privilege user via insufficient filtering of Docker volume-mount and device-mapping arguments passed to Docker-based MCP servers. By injecting unsanitized flags such as --volume into MCP server configuration, an attacker can bind-mount arbitrary host directories into a spawned container, exposing or tampering with sensitive files outside the intended Docker isolation boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold valid Langflow credentials at any privilege level (PR:L - no administrator role is required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.8, reflecting a network-exploitable, low-complexity attack requiring only low-privilege credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Langflow user with no special privileges navigates to the MCP server configuration panel and creates a new Docker-based MCP server, injecting a volume-mount argument such as -v /etc:/mnt/host into the server definition. When Langflow spawns the container for this MCP server, the host's /etc directory is mounted inside the container, allowing the attacker to read /etc/shadow for offline password cracking, extract SSH authorized_keys, or overwrite cron jobs and sudoers files to establish persistent host access. … |
| Remediation | Patch available per vendor advisory from IBM at https://www.ibm.com/support/pages/node/7282147. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Langflow versions 1.0.0 through 1.10.3 and restrict external network access; review authentication logs for suspicious activity and unauthorized file operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Unauthenticated remote code execution in Kestra orchestration platform before 1.0.45 and 1.3.21 lets anonymous attackers
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today