CVE-2026-17626: Langflow Docker MCP volume-mount flaw

CISO Take

IBM Langflow's handling of Docker-based MCP server integrations incompletely filters volume-mount and device-mapping arguments, letting an authenticated low-privileged user read, modify, or expose sensitive files on the underlying host — a container-escape-adjacent flaw scoring CVSS 8.8 with full confidentiality, integrity, and availability impact. This matters because Langflow is a widely-deployed agent orchestration platform, and any low-privilege, network-reachable account (no user interaction required) can potentially pivot from the app layer to the host, exposing credentials, secrets, or adjacent infrastructure. Exploitation likelihood sits in the top 21% by EPSS percentile with no public exploit code, no Nuclei scanner template, and it is not in CISA KEV — CISA's own SSVC decision is TRACK, the lowest urgency tier, so this is not an active-exploitation emergency today. Given the low technical bar (only requires an authenticated account, not deep AI/ML expertise) against a high blast radius if a malicious insider or compromised low-privilege credential is present, prioritize upgrading past 1.10.3 to a patched Langflow release, and in the meantime restrict who can configure or invoke Docker-based MCP server integrations and audit the container runtime privileges granted to the Langflow service.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

High severity (CVSS 8.8) but currently low imminent-exploitation risk: attack requires only network access and low privileges with no user interaction, and impact is complete (C:H/I:H/A:H) because it can expose or tamper with arbitrary host files. However, EPSS remains low in absolute terms (0.29%, ~79th percentile), there is no known public exploit or scanner coverage, and CISA's SSVC rates it TRACK (monitor, no urgent action). The realistic risk driver is insider threat or credential compromise rather than opportunistic internet-wide scanning — any org running Langflow with self-service or multi-tenant access to MCP server configuration should treat this as a priority patch, not an emergency one.

How does the attack unfold?

Initial Access

An adversary with a low-privileged, authenticated Langflow account configures or invokes a Docker-based MCP server integration within a flow.

AML.T0053

Argument Manipulation

The attacker supplies crafted Docker volume-mount or device-mapping arguments that bypass Langflow's incomplete filtering.

Escape to Host

The MCP server container launches with the attacker's mounts, exposing sensitive host filesystem paths inside the container.

AML.T0105

Impact

The attacker reads, modifies, or exfiltrates sensitive host files (credentials, configs, other tenants' data), achieving confidentiality, integrity, and availability compromise beyond the Langflow application.

Initial Access

An adversary with a low-privileged, authenticated Langflow account configures or invokes a Docker-based MCP server integration within a flow.

AML.T0053

Argument Manipulation

The attacker supplies crafted Docker volume-mount or device-mapping arguments that bypass Langflow's incomplete filtering.

Escape to Host

The MCP server container launches with the attacker's mounts, exposing sensitive host filesystem paths inside the container.

AML.T0105

Impact

The attacker reads, modifies, or exfiltrates sensitive host files (credentials, configs, other tenants' data), achieving confidentiality, integrity, and availability compromise beyond the Langflow application.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to the fixed release beyond 1.10.3 per IBM's advisory (https://www.ibm.com/support/pages/node/7282147). 2) Until patched, restrict which users/roles can create or configure Docker-based MCP server integrations — treat this as a privileged capability, not a default builder permission. 3) Run MCP server containers with minimal Docker capabilities (no --privileged, no arbitrary --volume/--device flags accepted from user input) and enforce an allowlist of permitted mount paths at the orchestration layer. 4) Audit existing MCP server configurations for unexpected host-path volume mounts or device mappings. 5) Monitor container runtime logs for anomalous mount requests or file access outside expected application directories as a detection signal.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Framework Agent Plugin AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8.3 - Technological safeguards for AI system security

NIST AI RMF

MANAGE-1.1 - Third-party AI resource risk management

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-17626?

IBM Langflow's handling of Docker-based MCP server integrations incompletely filters volume-mount and device-mapping arguments, letting an authenticated low-privileged user read, modify, or expose sensitive files on the underlying host — a container-escape-adjacent flaw scoring CVSS 8.8 with full confidentiality, integrity, and availability impact. This matters because Langflow is a widely-deployed agent orchestration platform, and any low-privilege, network-reachable account (no user interaction required) can potentially pivot from the app layer to the host, exposing credentials, secrets, or adjacent infrastructure. Exploitation likelihood sits in the top 21% by EPSS percentile with no public exploit code, no Nuclei scanner template, and it is not in CISA KEV — CISA's own SSVC decision is TRACK, the lowest urgency tier, so this is not an active-exploitation emergency today. Given the low technical bar (only requires an authenticated account, not deep AI/ML expertise) against a high blast radius if a malicious insider or compromised low-privilege credential is present, prioritize upgrading past 1.10.3 to a patched Langflow release, and in the meantime restrict who can configure or invoke Docker-based MCP server integrations and audit the container runtime privileges granted to the Langflow service.

Is CVE-2026-17626 actively exploited?

No confirmed active exploitation of CVE-2026-17626 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17626?

1) Upgrade Langflow to the fixed release beyond 1.10.3 per IBM's advisory (https://www.ibm.com/support/pages/node/7282147). 2) Until patched, restrict which users/roles can create or configure Docker-based MCP server integrations — treat this as a privileged capability, not a default builder permission. 3) Run MCP server containers with minimal Docker capabilities (no --privileged, no arbitrary --volume/--device flags accepted from user input) and enforce an allowlist of permitted mount paths at the orchestration layer. 4) Audit existing MCP server configurations for unexpected host-path volume mounts or device mappings. 5) Monitor container runtime logs for anomalous mount requests or file access outside expected application directories as a detection signal.

What systems are affected by CVE-2026-17626?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, containerized model serving.

What is the CVSS score for CVE-2026-17626?

CVE-2026-17626 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationscontainerized model serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

Compliance Controls Affected

ISO 42001: A.8.3

NIST AI RMF: MANAGE-1.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.

Exploitation Scenario

An adversary who has obtained or been granted a low-privileged Langflow account (e.g., a contractor, compromised credential, or malicious insider) creates or edits a Docker-based MCP server integration within a Langflow flow. Instead of using a legitimate configuration, they supply crafted volume-mount or device-mapping arguments that Langflow's filtering fails to block. When the MCP server container is launched, the attacker's mount points map sensitive host directories (e.g., credential stores, other tenants' data, or host configuration files) into the container, giving them read/write access to files never intended to be exposed to the Langflow application layer — enabling data theft, lateral movement, or host-level tampering without needing an exploit chain or public tooling.

Weaknesses (CWE)

CWE-266 Incorrect Privilege Assignment Primary CWE-266 Incorrect Privilege Assignment

CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Source: MITRE CWE corpus.