Executive brief
IBM Langflow OSS, a visual tool for building AI-powered agent workflows, contains a critical security flaw in its Model Context Protocol (MCP) component. An unauthenticated attacker can remotely execute arbitrary commands on the server hosting the application. This could lead to a complete system takeover, unauthorized access to sensitive AI models and data, or disruption of business operations.
Technical details
IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to OS command injection (CWE-78) within the Model Context Protocol (MCP) stdio launcher. The vulnerability is located in 'src/lfx/src/lfx/base/mcp/util.py', where the 'DANGEROUS_ENV_VARS' blocklist fails to include sensitive environment variables such as SHELLOPTS, BASHOPTS, and PS4. An unauthenticated remote attacker can exploit this by injecting these variables during the MCP server configuration process to achieve arbitrary code execution with the privileges of the service process. IBM recommends upgrading to Langflow OSS version 1.10.2 to remediate this issue.
Affected products
- IBM Langflow OSS 1.0.0 - 1.10.1
Timeline
- 2026-07-14: advisory: Initial publication of IBM security bulletin
- 2026-07-30: disclosed: NVD publication date