CVE-2026-7755: Langflow MCP config validation gap

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.10.0 fail to fully enforce validation on MCP server configuration files, letting an authenticated low-privilege user achieve remote code execution on the Langflow host. The CVSS 8.8 score (network vector, low complexity, low privileges, no user interaction, full C/I/A impact) reflects an unusually easy path to full compromise for an AI agent orchestration platform. There is no evidence of active exploitation yet — it isn't in CISA KEV, no EPSS score is available, and no public exploit or Nuclei template exists — but Langflow's role as an agent/MCP integration hub makes it a high-value target once tooling appears. Inventory every Langflow instance (1.0.0-1.10.0), lock down who can create or edit MCP server configs, and watch IBM's advisory for a patched release to apply immediately.

Sources: NVD ATLAS ibm.com

What is the risk?

High severity (CVSS 8.8) driven by low attack complexity, low privilege requirement, and no user interaction — a low-privileged Langflow user can trigger full remote code execution. Exploitation likelihood is currently unconfirmed (no EPSS percentile, not in CISA KEV, no public PoC or scanner template found), so this sits in a 'high impact, unproven exploitation' bucket that can shift quickly once researchers or attackers reverse-engineer the validation gap. Risk is elevated further by Langflow's growing adoption as an agent/MCP orchestration layer, meaning a single compromised instance can expose credentials and tooling for downstream AI pipelines.

How does the attack unfold?

Initial Access

A low-privileged authenticated user submits a crafted MCP server configuration through Langflow's public-facing UI or API.

AML.T0049

Configuration Tampering

Incomplete validation enforcement lets Langflow accept and persist the malicious MCP server configuration.

AML.T0081

Code Execution

The malicious configuration triggers execution of attacker-controlled commands in the Langflow server's process context.

AML.T0050

Impact

Attacker achieves full confidentiality, integrity, and availability compromise of the Langflow host and any credentials or pipelines it manages.

Initial Access

A low-privileged authenticated user submits a crafted MCP server configuration through Langflow's public-facing UI or API.

AML.T0049

Configuration Tampering

Incomplete validation enforcement lets Langflow accept and persist the malicious MCP server configuration.

AML.T0081

Code Execution

The malicious configuration triggers execution of attacker-controlled commands in the Langflow server's process context.

AML.T0050

Impact

Attacker achieves full confidentiality, integrity, and availability compromise of the Langflow host and any credentials or pipelines it manages.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade to a patched Langflow release above 1.10.0 as soon as IBM/Langflow publishes one; track the vendor advisory at the reference URL for the fix version. Until patched, restrict MCP server configuration creation/editing to trusted administrators only (remove this capability from standard editor/contributor roles). Audit existing MCP server configs for unauthorized entries. Run Langflow in a least-privilege, network-segmented container so RCE cannot pivot laterally, and monitor process/command execution on Langflow hosts for anomalous child processes spawned by the Langflow service account.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Framework Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

8.1 - Operational planning and control

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-7755?

IBM Langflow OSS versions 1.0.0 through 1.10.0 fail to fully enforce validation on MCP server configuration files, letting an authenticated low-privilege user achieve remote code execution on the Langflow host. The CVSS 8.8 score (network vector, low complexity, low privileges, no user interaction, full C/I/A impact) reflects an unusually easy path to full compromise for an AI agent orchestration platform. There is no evidence of active exploitation yet — it isn't in CISA KEV, no EPSS score is available, and no public exploit or Nuclei template exists — but Langflow's role as an agent/MCP integration hub makes it a high-value target once tooling appears. Inventory every Langflow instance (1.0.0-1.10.0), lock down who can create or edit MCP server configs, and watch IBM's advisory for a patched release to apply immediately.

Is CVE-2026-7755 actively exploited?

No confirmed active exploitation of CVE-2026-7755 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7755?

Upgrade to a patched Langflow release above 1.10.0 as soon as IBM/Langflow publishes one; track the vendor advisory at the reference URL for the fix version. Until patched, restrict MCP server configuration creation/editing to trusted administrators only (remove this capability from standard editor/contributor roles). Audit existing MCP server configs for unauthorized entries. Run Langflow in a least-privilege, network-segmented container so RCE cannot pivot laterally, and monitor process/command execution on Langflow hosts for anomalous child processes spawned by the Langflow service account.

What systems are affected by CVE-2026-7755?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integration, AI pipeline orchestration.

What is the CVSS score for CVE-2026-7755?

CVE-2026-7755 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.75%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationAI pipeline orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.1

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.

Exploitation Scenario

An attacker with a low-privileged account on a shared or multi-tenant Langflow instance (e.g., a flow editor role) submits a crafted MCP server configuration through the Langflow UI or API. Because Langflow's validation enforcement on these config files is incomplete, the malformed configuration is accepted and processed, allowing attacker-controlled commands to execute in the Langflow server's context. The attacker gains full read/write/execute access to the host, harvesting API keys and credentials used by connected LLM agents and tool integrations, and potentially using that foothold to pivot into other systems the Langflow pipeline touches.