CVE-2026-81941: Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOWCUSTOMCOMPONENTADMINONLY and LANGFLOWBLOCKCODEINTERPRETERCOMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
Other sources
Langflow OSS allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOWCUSTOMCOMPONENTADMINONLY and LANGFLOWBLOCKCODEINTERPRETERCOMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-administrative Langflow OSS user can exploit it by creating a flow that uses an MCP Tools component configured with a local stdio subprocess transport. The resulting commands run with the privileges of the Langflow application process.
Do the server-side component restrictions prevent exploitation?
No. Exploitation bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS controls, even though those controls are intended to restrict this type of access.
What is the likely impact if exploitation succeeds?
An attacker can execute arbitrary operating system commands, access sensitive information such as credentials in the application process environment, modify files, and potentially move laterally to services reachable from the server.