CVE-2026-81941

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an improper access control flaw (CWE-284) that lets an authenticated non-administrative user execute arbitrary operating system commands on the server at the privilege level of the application process. It is triggered by constructing a flow that includes an MCP Tools component configured to use a local stdio subprocess transport, which spawns the subprocess without honoring server-side restrictions. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS controls that are specifically intended to prevent this class of access. A successful attacker gains arbitrary command execution, access to sensitive data including credentials from the process environment, the ability to modify the file system, and a path for lateral movement to services reachable from the server; CVSS rates this 8.8 (high). Any deployment running affected versions in which non-admin users can build flows is affected; there is currently no known exploitation, no public proof-of-concept, and the issue is not in CISA's KEV.

What to do: Upgrade Langflow to a release later than 1.11.5 as directed by IBM's advisory (no fixed version number is stated in this data), prioritizing instances where non-admin users can create or edit flows. Until patched, restrict flow creation and editing to trusted administrators, avoid exposing the Langflow server to untrusted networks, and limit secrets in the application process environment plus its lateral network reach. Note that the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS controls do not mitigate this issue, since both are bypassed.