Langflow: IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-17626
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 5, 2026
- Source last modified
- October 23, 2026
Description
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.
Description quoted from the NVD record.
Who is affected
Langflow (also called IBM Langflow OSS) is a tool for building apps that use AI language models. This flaw affects versions 1.0.0 through 1.10.3. It involves the feature that connects Langflow to add-on tool servers (called MCP servers) that run inside Docker, a system for running software in separate containers. Langflow does not fully block risky settings when these servers are started. Because of this, someone who already has a login to Langflow could read, change, or expose sensitive files on the computer that Langflow runs on. This flaw is rated High.
What to do
- Find out who runs Langflow for your organization: the person who installed it, or the IT provider or vendor who manages it.
- If you run it yourself, check which version you have. Versions 1.0.0 through 1.10.3 are affected.
- No fixed version is named for this flaw yet. Check the vendor advisory linked on this page for a fixed release, and install it once it is available.
- If an IT provider or vendor runs Langflow for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 23, 2026 and reviewed before publishing.