CVE-2026-78575

CVE-2026-78575 is a command injection flaw (CWE-78) in IBM Langflow OSS, the open-source visual framework for building AI agent and workflow applications, caused by improper validation of command-line arguments in the MCP stdio server configuration. An authenticated remote attacker can supply crafted arguments through that configuration, and Langflow executes arbitrary commands when it spawns the MCP stdio server process. Successful exploitation gives arbitrary command execution with the privileges of the Langflow process, with high impact on confidentiality, integrity, and availability (CVSS 3.1 8.8; low privileges required, no user interaction). All deployments running Langflow OSS 1.0.0 through 1.11.5 are affected per IBM's advisory; the data does not address pre-1.0.0 releases. The flaw is not in CISA's KEV and no public proof-of-concept is known, so no in-the-wild exploitation has been reported.

What to do: Upgrade Langflow OSS to a fixed release beyond 1.11.5 as soon as IBM publishes one in its advisory (no fixed version is listed in the data). Until then, restrict creation and editing of MCP stdio server configurations to trusted administrators, audit existing MCP stdio server entries for unexpected arguments or shell metacharacters, and limit Langflow access to authenticated trusted users. Avoid letting untrusted users define the command and arguments used to launch MCP stdio servers.