Executive brief
Langflow is an open-source application development platform used to build AI-powered workflows and agents. This vulnerability allows unauthenticated attackers to execute arbitrary code and access or modify chat sessions when MCP (Model Context Protocol) project endpoints are publicly shared, due to missing security checks on public flows. Successful exploitation could lead to complete server compromise, data theft, and unauthorized modifications to user interactions.
Technical details
CVE-2026-85025 is a broken access control vulnerability (CWE-863) affecting Langflow 1.0.0 through 1.11.5. Publicly shared MCP project transports and public flows containing MCP Tools components fail to apply the code-execution guard and session namespace scoping controls that are enforced on other anonymous execution surfaces. An unauthenticated network attacker can reach affected endpoints without authentication or user interaction, send malicious requests to publicly shared MCP endpoints to execute arbitrary code at the application's privilege level, and access or modify chat session data across users. The root cause is improper enforcement of security restrictions when MCP components are used in public flows. Patches are expected from IBM through standard security updates.
Affected products
- IBM Langflow 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed