EUVD-2026-75780
GHSA-m5q4-pf3r-r78g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible via web UI, low complexity; PR:L because a valid non-admin account is required; full CIA impact on the server process matches credential theft, file modification, and availability disruption described.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
AnalysisAI
Authenticated non-administrative users in IBM Langflow OSS 1.0.0-1.11.5 can execute arbitrary OS commands at the application process privilege level by constructing a flow that uses an MCP Tools component configured with a local stdio subprocess transport. This attack path explicitly circumvents both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side enforcement controls - meaning deployments that relied on these flags for protection are not protected against this specific vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session as any non-administrative Langflow user (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the exploitation profile: network-reachable via the Langflow web interface, low complexity, requiring only a valid non-admin account, with full confidentiality, integrity, and availability impact on the server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch documented in the IBM security advisory at https://www.ibm.com/support/pages/node/7286666. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Langflow instances running versions 1.0.0-1.11.5; audit authentication logs to determine which non-administrative users have access; disable MCP Tools components via application configuration or restrict access to administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitr
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with l
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Same weakness CWE-284 – Improper Access Control
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today