CVE-2026-12940: Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints
IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.
Other sources
Langflow versions through 1.9.6 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.2 - Compensating control
Restrict access to the MCP (Model Context Protocol) stdio launcher / MCP-related API endpoints so they are not reachable by unauthenticated users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12940?
CVE-2026-12940 has a critical severity score of 9.8.
How does CVE-2026-12940 affect IBM Langflow?
CVE-2026-12940 affects IBM Langflow by allowing unauthenticated remote code execution through environment variable injection.
What versions of IBM Langflow are impacted by CVE-2026-12940?
IBM Langflow OSS versions 1.0.0 through 1.10.1 are impacted by CVE-2026-12940.
How can CVE-2026-12940 be mitigated?
To mitigate CVE-2026-12940, users should upgrade to a patched version of IBM Langflow that addresses this vulnerability.
What type of vulnerability is CVE-2026-12940 classified as?
CVE-2026-12940 is classified as an OS Command Injection vulnerability.