Langflow discloses five CVEs against its MCP Tools component, including a critical unauthenticated code execution bug, all already fixed

IBM's CNA, which now issues security records for Langflow (each description names the product "IBM Langflow OSS"), published five CVE records against Langflow's MCP Tools component between 2026-09-04 and 2026-09-14. None are cataloged here as entities.

The worst is CVE-2026-85025, critical at CVSS 3.1 9.8, reserved 2026-09-02 and published 2026-09-10. It let an unauthenticated attacker execute arbitrary code and tamper with chat sessions through publicly shared MCP project endpoints, which did not apply the same public-flow security restrictions and session isolation enforced on other anonymous execution surfaces. Two high-severity records, both 8.8, describe separate paths to command execution through the same component's stdio transport. CVE-2026-81941 let an authenticated non-admin user run arbitrary operating system commands by configuring an MCP Tools component for a local stdio subprocess, bypassing both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS controls meant to stop exactly that. CVE-2026-78575 is a companion defect in the same configuration path: improper validation of the stdio server's command-line arguments. IBM's support page bundles all three under one bulletin and names v1.11.6 as the fix; that release published 2026-09-01, before any of the three records it closes.

CVE-2026-12763, medium at 4.2, is narrower: improper cache key isolation in the MCP Tools component let an authenticated attacker read another user's MCP server session context. It was reserved 2026-06-19 but not published until 2026-09-14, the latest date in this batch, and IBM's bulletin for it carries an initial-publication date of 2026-09-08, six days ahead of the CNA record. It is fixed in the same v1.11.6 release.

CVE-2026-9186, medium at 6.5, is the oldest and affects an earlier range, 1.0.0 through 1.11.2. A remote authenticated attacker could spoof the X-Forwarded-For: 127.0.0.1 header to bypass a localhost-only restriction on MCP configuration installation, writing to IDE config files such as ~/.cursor/mcp.json. It was published 2026-09-04 and fixed one release earlier than the rest, in v1.11.3 on 2026-08-11.