Langflow: IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-85025
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 10, 2026
- Source last modified
- September 15, 2026
Description
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.
Description quoted from the NVD record.
Who is affected
Langflow (also called IBM Langflow OSS) is a tool for building apps that use AI language models. This flaw affects versions 1.0.0 through 1.11.5. It involves projects that are shared publicly so other AI tools can connect to them (a feature known as MCP). Because the product does not properly enforce the safety limits on public projects or keep chat sessions separate, an attacker who has not logged in could run any commands they choose on the computer running Langflow and could read or change chat sessions. This flaw is rated Critical.
What to do
- If someone in your organization installed or runs Langflow, that person should handle this. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- Find out which version of Langflow you use. Versions 1.0.0 through 1.11.5 are affected.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- Once a fixed release is available, install it on every computer or server that runs Langflow.
Analysis written from the source record as of September 15, 2026 and reviewed before publishing.