CVE-2026-12940: Langflow unauth RCE

CISO Take

Langflow's Model Context Protocol (MCP) stdio launcher fails to strip the SHELLOPTS, BASHOPTS, and PS4 environment variables from its DANGEROUS_ENV_VARS blocklist, letting an attacker who can reach the MCP tool-launch endpoint smuggle a classic bash trick (PS4 command substitution under xtrace) into a spawned subprocess and execute arbitrary OS commands with zero authentication and zero user interaction. This deserves immediate attention: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) means any internet-reachable Langflow instance is a one-shot RCE target, and Langflow sits in the same class of agent-framework tooling — alongside Flowise, Ollama, and BentoML — that attackers have already weaponized with public Metasploit modules once technical details surface. There is no EPSS score, CISA KEV listing, or Nuclei template yet and no public exploit has been observed, but the underlying flaw (a missing entry in an env-var blocklist) is trivial to turn into a PoC once IBM's advisory circulates. Patch to the fixed Langflow release above 1.10.1 immediately; until then, block public access to Langflow's MCP endpoints and watch for Langflow child processes spawned with SHELLOPTS, BASHOPTS, or PS4 set. Treat any internet-facing Langflow deployment as compromised-until-patched given the pre-auth network vector.

Sources: NVD ATLAS ibm.com

What is the risk?

Critical. The combination of no authentication, no user interaction, low attack complexity, and full confidentiality/integrity/availability impact (CVSS 9.8) makes this a textbook pre-auth RCE. The only current mitigating factors are the absence of a CISA KEV listing, EPSS score, Nuclei template, or known public exploit — but those are lagging indicators, not evidence of low risk, given how mechanically simple the exploitation path (bash env var injection) is once the DANGEROUS_ENV_VARS gap is known. Langflow's popularity as a low-code AI agent/pipeline builder means exposure is plausibly widespread even though dependent-count and OpenSSF Scorecard data are unavailable here.

How does the attack unfold?

Unauthenticated Access

Attacker sends a network request to the Langflow instance's MCP tool-launch functionality without any authentication.

AML.T0049

Environment Variable Injection

Attacker supplies SHELLOPTS, BASHOPTS, or PS4 values that bypass the DANGEROUS_ENV_VARS blocklist and reach the spawned bash subprocess.

AML.T0050

Remote Code Execution

Bash evaluates PS4 as a command substitution during xtrace, executing arbitrary OS commands with the Langflow service's privileges.

AML.T0072

Post-Exploitation Impact

Attacker exfiltrates credentials or establishes persistence, compromising every AI pipeline and tool Langflow orchestrates.

AML.T0112

Unauthenticated Access

Attacker sends a network request to the Langflow instance's MCP tool-launch functionality without any authentication.

AML.T0049

Environment Variable Injection

Attacker supplies SHELLOPTS, BASHOPTS, or PS4 values that bypass the DANGEROUS_ENV_VARS blocklist and reach the spawned bash subprocess.

AML.T0050

Remote Code Execution

Bash evaluates PS4 as a command substitution during xtrace, executing arbitrary OS commands with the Langflow service's privileges.

AML.T0072

Post-Exploitation Impact

Attacker exfiltrates credentials or establishes persistence, compromising every AI pipeline and tool Langflow orchestrates.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
152.4K Pushed 5d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow past 1.10.1 to the version referenced in IBM's advisory as soon as it is available. 2) Until patched, do not expose Langflow's MCP endpoints to the public internet — restrict access to trusted internal/VPN networks only. 3) Detect exploitation attempts by monitoring for Langflow child processes spawned with SHELLOPTS, BASHOPTS, or PS4 environment variables set, or unexpected bash processes running with xtrace enabled. 4) Rotate any credentials (LLM API keys, vector DB creds, other service tokens) reachable from the Langflow host, since RCE could have exfiltrated them even without visible signs. 5) Audit any other internally built MCP-server launchers for the same class of env-var blocklist gap — this is a generalizable design flaw, not a Langflow-only bug.

How is it classified?

Code Execution Framework Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0072 - Reverse Shell AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Third-party and customer requirements

NIST AI RMF

MANAGE-4.1 - Risks from third-party AI resources are catalogued and monitored

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-12940?

Langflow's Model Context Protocol (MCP) stdio launcher fails to strip the SHELLOPTS, BASHOPTS, and PS4 environment variables from its DANGEROUS_ENV_VARS blocklist, letting an attacker who can reach the MCP tool-launch endpoint smuggle a classic bash trick (PS4 command substitution under xtrace) into a spawned subprocess and execute arbitrary OS commands with zero authentication and zero user interaction. This deserves immediate attention: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) means any internet-reachable Langflow instance is a one-shot RCE target, and Langflow sits in the same class of agent-framework tooling — alongside Flowise, Ollama, and BentoML — that attackers have already weaponized with public Metasploit modules once technical details surface. There is no EPSS score, CISA KEV listing, or Nuclei template yet and no public exploit has been observed, but the underlying flaw (a missing entry in an env-var blocklist) is trivial to turn into a PoC once IBM's advisory circulates. Patch to the fixed Langflow release above 1.10.1 immediately; until then, block public access to Langflow's MCP endpoints and watch for Langflow child processes spawned with SHELLOPTS, BASHOPTS, or PS4 set. Treat any internet-facing Langflow deployment as compromised-until-patched given the pre-auth network vector.

Is CVE-2026-12940 actively exploited?

No confirmed active exploitation of CVE-2026-12940 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12940?

1) Upgrade Langflow past 1.10.1 to the version referenced in IBM's advisory as soon as it is available. 2) Until patched, do not expose Langflow's MCP endpoints to the public internet — restrict access to trusted internal/VPN networks only. 3) Detect exploitation attempts by monitoring for Langflow child processes spawned with SHELLOPTS, BASHOPTS, or PS4 environment variables set, or unexpected bash processes running with xtrace enabled. 4) Rotate any credentials (LLM API keys, vector DB creds, other service tokens) reachable from the Langflow host, since RCE could have exfiltrated them even without visible signs. 5) Audit any other internally built MCP-server launchers for the same class of env-var blocklist gap — this is a generalizable design flaw, not a Langflow-only bug.

What systems are affected by CVE-2026-12940?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI pipeline orchestration, MCP tool integration, RAG pipelines.

What is the CVSS score for CVE-2026-12940?

CVE-2026-12940 has a CVSS v3.1 base score of 9.8 (CRITICAL).

What is the AI security impact?

Affected AI Architectures

agent frameworksAI pipeline orchestrationMCP tool integrationRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0072 Reverse Shell

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.

Exploitation Scenario

An adversary scans for internet-facing Langflow instances and sends an unauthenticated request that triggers Langflow's MCP stdio launcher to spawn a subprocess, crafting the request so that SHELLOPTS, BASHOPTS, or PS4 are set in the resulting environment. Because Langflow's blocklist doesn't strip these variables, bash evaluates PS4 (normally used for xtrace prompts) as a command substitution, executing attacker-supplied shell commands with the privileges of the Langflow service account. From there the attacker reads local secrets such as LLM API keys and vector store credentials, pivots to other systems the Langflow pipeline orchestrates, or drops a reverse shell for persistence — all without ever authenticating to the application.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.