AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-85025criticalCode execution2026-09-10

CVE-2026-85025: Langflow before 1.11.6 has 11 code-execution bugs, including unauthenticated RCE through shared MCP projects

An IBM security bulletin lists 11 CVEs in Langflow OSS 1.0.0 through 1.11.5, all fixed in 1.11.6. The worst, CVE-2026-85025, lets an unauthenticated attacker run code and read or change chat sessions through publicly shared MCP project endpoints. The others let authenticated users run code or commands through scanner bypasses, stored flows and MCP stdio settings.

01.

What it is

CVE-2026-85025: publicly shared MCP project transports and public flows with MCP Tools components skip the public-flow code-execution guard and session scoping, so anonymous callers can execute code and tamper with chat sessions.

CVE-2026-79724 (OS command injection, CVSS 9.8) and CVE-2026-81204 (code injection during graph construction): remote code execution in Langflow OSS.

Authenticated paths to code execution: custom components in stored flows skip the admin-only policy (CVE-2026-81211), a non-admin can build a flow that runs OS commands (CVE-2026-81941), flow display names aren't neutralized (CVE-2026-81940), the security scanner's denylist is incomplete or can be bypassed with annotated class-body assignments (CVE-2026-78569, CVE-2026-76059), and the lfx CodeParser passes annotation source to eval() (CVE-2026-78571).

MCP stdio server configuration: on Windows only one cmd.exe switch is recognized, so others bypass the allow-list (CVE-2026-78575), and OPENSSL_CONF is missing from the environment blocklist, which allows native code loading (CVE-2026-79742).

02.

How to check

  1. Affected: Langflow OSS 1.0.0 through 1.11.5.
  2. You are most exposed if you share MCP projects or flows publicly, or let users you don't fully trust log in.
03.

How to fix

  1. Upgrade Langflow to 1.11.6 or later. IBM lists no workarounds.
  2. Until you upgrade, stop sharing MCP projects and public flows and keep the instance off the public internet.
pip show langflow | grep -i version
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.