AI Threat Alert
CVE-2026-81941: Langflow: MCP stdio tool bypasses RCE lockdown
HIGHIBM Langflow lets any authenticated non-admin user build a flow that wires an MCP Tools component to a local stdio subprocess transport, and executing that flow runs arbitrary OS commands at the privilege level of the Langflow process. What makes this one sting is that it defeats two controls administrators specifically deployed to prevent this exact outcome — LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS — meaning any org that thought it had locked down code execution for low-privilege users is still exposed. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, but the CVSS 8.8 (network, low complexity, no user interaction) combined with a low privilege bar means any low-trust internal user or shared-tenant flow builder is a viable attacker. Patch to the fixed Langflow release referenced in IBM's advisory as soon as it's available; until then, treat MCP Tools components with stdio transport as equivalent to raw code-execution and restrict flow-creation/edit rights to trusted users only, since the existing admin-only and code-interpreter flags cannot be relied on. Detection-wise, audit for flows containing MCP Tools components configured with stdio subprocess transport and monitor Langflow process child-process spawns for anomalous shell activity.
What is the risk?
High risk despite the absence of KEV listing or a known EPSS score. The exploit path requires only low-privilege authenticated access (PR:L) and no user interaction, over the network, with low attack complexity — a combination that historically correlates with rapid weaponization once details circulate. The impact is full C/I/A compromise of the host process, and the fact that it bypasses two purpose-built server-side security controls means environments that believed themselves hardened against this class of abuse are not. Any multi-tenant or shared Langflow deployment where non-admins can author flows should treat this as urgent.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Patch to the fixed Langflow version referenced in IBM's advisory (ibm.com/support/pages/node/7286666) as soon as released. 2) Until patched, restrict flow authoring/editing permissions to fully trusted/admin users only — do not rely on LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY or LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS as a compensating control, since both are bypassed. 3) Audit existing flows for MCP Tools components configured with stdio subprocess transport and remove/disable where not explicitly required. 4) Run the Langflow application process with least-privilege OS credentials and restrict outbound network access from the host to limit lateral movement if exploited. 5) Monitor process-spawn telemetry (EDR/auditd) on Langflow hosts for unexpected child processes originating from the application, and rotate any credentials present in the process environment as a precaution.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-81941?
IBM Langflow lets any authenticated non-admin user build a flow that wires an MCP Tools component to a local stdio subprocess transport, and executing that flow runs arbitrary OS commands at the privilege level of the Langflow process. What makes this one sting is that it defeats two controls administrators specifically deployed to prevent this exact outcome — LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS — meaning any org that thought it had locked down code execution for low-privilege users is still exposed. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, but the CVSS 8.8 (network, low complexity, no user interaction) combined with a low privilege bar means any low-trust internal user or shared-tenant flow builder is a viable attacker. Patch to the fixed Langflow release referenced in IBM's advisory as soon as it's available; until then, treat MCP Tools components with stdio transport as equivalent to raw code-execution and restrict flow-creation/edit rights to trusted users only, since the existing admin-only and code-interpreter flags cannot be relied on. Detection-wise, audit for flows containing MCP Tools components configured with stdio subprocess transport and monitor Langflow process child-process spawns for anomalous shell activity.
Is CVE-2026-81941 actively exploited?
No confirmed active exploitation of CVE-2026-81941 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-81941?
1) Patch to the fixed Langflow version referenced in IBM's advisory (ibm.com/support/pages/node/7286666) as soon as released. 2) Until patched, restrict flow authoring/editing permissions to fully trusted/admin users only — do not rely on LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY or LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS as a compensating control, since both are bypassed. 3) Audit existing flows for MCP Tools components configured with stdio subprocess transport and remove/disable where not explicitly required. 4) Run the Langflow application process with least-privilege OS credentials and restrict outbound network access from the host to limit lateral movement if exploited. 5) Monitor process-spawn telemetry (EDR/auditd) on Langflow hosts for unexpected child processes originating from the application, and rotate any credentials present in the process environment as a precaution.
What systems are affected by CVE-2026-81941?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, low-code AI orchestration platforms.
What is the CVSS score for CVE-2026-81941?
CVE-2026-81941 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.76%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012 Valid Accounts AML.T0049 Exploit Public-Facing Application AML.T0050 Command and Scripting Interpreter AML.T0053 AI Agent Tool Invocation Compliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
Exploitation Scenario
An adversary who has obtained low-privilege, non-administrative credentials to a shared Langflow instance (e.g., via phishing, credential stuffing, or a legitimately provisioned but restricted account) builds a new flow through the normal UI/API. Within that flow they add an MCP Tools component and configure it to use a local stdio subprocess transport, then define the tool's command to execute an OS-level payload. When the flow is run, Langflow's backend spawns the subprocess with the payload, executing arbitrary commands at the privilege level of the Langflow application — despite admin-only and code-interpreter-blocking controls being enabled. From there, the attacker harvests credentials from the process environment, modifies the filesystem, and pivots to other services reachable from the Langflow host.
Weaknesses (CWE)
CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References
Timeline
Related Vulnerabilities
CVE-2026-10561 10.0 Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflow CVE-2026-10134 10.0 Langflow: unauthenticated RCE via tool_code injection
Same package: langflow CVE-2026-33309 9.9 langflow: Path Traversal enables file access
Same package: langflow CVE-2026-55255 9.9 Langflow: IDOR allows cross-user flow execution
Same package: langflow CVE-2026-7873 9.9 Langflow: authenticated RCE enables credential theft
Same package: langflow