Executive brief
IBM Langflow OSS is an open-source platform for building and managing AI workflows. A remote authenticated attacker can execute arbitrary code on the server by exploiting an incomplete blocklist of environment variables, specifically leveraging the OPENSSL_CONF variable to load malicious OpenSSL engines. This allows attackers to compromise the server, access sensitive data stored in the application, and potentially move laterally to other systems.
Technical details
The vulnerability is a code injection flaw resulting from an incomplete environment variable blocklist in the MCP stdio validator. Specifically, the OPENSSL_CONF environment variable is not blocked, allowing an attacker to set it to point to a malicious OpenSSL configuration file that loads arbitrary native code via OpenSSL engine loading. The vulnerability requires authentication but operates over the network with no additional user interaction. An authenticated attacker can construct a flow with an MCP Tools component using a local stdio subprocess transport to execute arbitrary OS commands at the privilege level of the Langflow application process, bypassing server-side code execution controls. Patched versions are available; users should upgrade to version 1.11.6 or later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed: CVE-2026-79742 published
- 2026-09-10: other: Part of broader Langflow security bulletin covering multiple RCE vulnerabilities