Langflow: IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-81941
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 10, 2026
- Source last modified
- September 16, 2026
Description
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
Description quoted from the NVD record.
Who is affected
Langflow (also called IBM Langflow OSS) is a tool for building apps that use AI language models by linking building blocks into workflows. This flaw affects versions 1.0.0 through 1.11.5. Anyone with an ordinary account, not an administrator account, can build a workflow that uses the building block for connecting to outside tools and set it to run a program on the server. This lets them run any command on the server, read sensitive data such as passwords and keys the program uses, change files, and reach other systems the server can reach. The settings meant to stop this do not block it. This flaw is rated High.
What to do
- The person who installed or runs Langflow for your organization should handle this, or your IT provider if one manages it for you.
- No fixed version is named for this flaw yet. Check the vendor advisory linked on this page for a fixed release, and install it as soon as it is available.
- Do not rely on the settings that limit custom code to administrators to protect you, because this flaw gets around them.
- If an IT provider or vendor runs Langflow for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 16, 2026 and reviewed before publishing.