CVE-2026-85025: Langflow unauth RCE

CISO Take

IBM Langflow, an open-source visual builder widely used to construct LLM agent and RAG pipelines, has a critical flaw (CVSS 9.8) where publicly shared flows exposed as MCP project endpoints fail to enforce their intended security restrictions and session isolation, letting an unauthenticated network attacker execute arbitrary code and read or tamper with other users' chat sessions. There's no public exploit, PoC, or Nuclei template yet and it isn't in CISA KEV, so this hasn't been weaponized in the wild — but the bar to exploit is trivial (AV:N/AC:L/PR:N/UI:N) once someone reverse-engineers the flaw, and Langflow instances with publicly shared MCP flows are discoverable via standard internet scanning. Any org running Langflow to expose agent workflows or tools via MCP should treat every internet-facing instance as compromised-until-patched, since the blast radius includes full host RCE plus exposure of other tenants' conversation data and any credentials embedded in flows. Patch to the fixed Langflow release above 1.11.5 immediately, and in the interim disable public sharing on MCP project endpoints or take Langflow instances off the public internet entirely while auditing what's currently shared publicly.

Sources: NVD ibm.com ATLAS

What is the risk?

Critical. CVSS 9.8 with full network exploitability, no authentication or user interaction required, and complete compromise of confidentiality, integrity, and availability (arbitrary code execution). No active exploitation observed (not in CISA KEV, no EPSS score, no public exploit or scanner template known), which lowers immediate urgency but not the ceiling — this is the kind of unauthenticated-RCE-in-an-AI-orchestration-tool bug that typically gets weaponized fast once details circulate, given how simple the exploit conditions are (AC:L, no auth, no UI). Exposure hinges entirely on whether an organization has Langflow instances reachable from the internet with public flow/MCP sharing enabled.

How does the attack unfold?

Discovery

Attacker locates an internet-facing Langflow instance with a publicly shared flow exposed via an MCP project endpoint.

AML.T0049

Exploitation

Attacker sends an unauthenticated request exploiting improper enforcement of public-flow security restrictions to achieve arbitrary code execution on the host.

AML.T0049

Session compromise

Broken session isolation lets the attacker access or modify other users' chat sessions on the same instance, exposing conversation data and any embedded secrets.

AML.T0092

Impact

Attacker uses the code-execution foothold to exfiltrate data, harvest credentials, or pivot further into the hosting environment.

AML.T0025

Discovery

Attacker locates an internet-facing Langflow instance with a publicly shared flow exposed via an MCP project endpoint.

AML.T0049

Exploitation

Attacker sends an unauthenticated request exploiting improper enforcement of public-flow security restrictions to achieve arbitrary code execution on the host.

AML.T0049

Session compromise

Broken session isolation lets the attacker access or modify other users' chat sessions on the same instance, exposing conversation data and any embedded secrets.

AML.T0092

Impact

Attacker uses the code-execution foothold to exfiltrate data, harvest credentials, or pivot further into the hosting environment.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch Langflow to the fixed release above 1.11.5 as soon as IBM/Langflow publishes it — track the linked advisory for the exact version. 2) Until patched, disable public sharing on any Langflow flow/project exposed via MCP endpoints, or take internet-facing Langflow instances offline / behind authentication (VPN, reverse-proxy auth, IP allowlist). 3) Audit which flows are currently marked public and rotate any credentials or API keys embedded in those flows, since they may already be exposed. 4) Monitor Langflow host logs for anomalous process execution, unexpected outbound connections, or session access patterns inconsistent with normal per-user boundaries. 5) Restrict network exposure so Langflow MCP endpoints are never directly reachable from the public internet without an additional auth layer.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Leakage Framework Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0092 - Manipulate User LLM Chat History

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-85025?

IBM Langflow, an open-source visual builder widely used to construct LLM agent and RAG pipelines, has a critical flaw (CVSS 9.8) where publicly shared flows exposed as MCP project endpoints fail to enforce their intended security restrictions and session isolation, letting an unauthenticated network attacker execute arbitrary code and read or tamper with other users' chat sessions. There's no public exploit, PoC, or Nuclei template yet and it isn't in CISA KEV, so this hasn't been weaponized in the wild — but the bar to exploit is trivial (AV:N/AC:L/PR:N/UI:N) once someone reverse-engineers the flaw, and Langflow instances with publicly shared MCP flows are discoverable via standard internet scanning. Any org running Langflow to expose agent workflows or tools via MCP should treat every internet-facing instance as compromised-until-patched, since the blast radius includes full host RCE plus exposure of other tenants' conversation data and any credentials embedded in flows. Patch to the fixed Langflow release above 1.11.5 immediately, and in the interim disable public sharing on MCP project endpoints or take Langflow instances off the public internet entirely while auditing what's currently shared publicly.

Is CVE-2026-85025 actively exploited?

No confirmed active exploitation of CVE-2026-85025 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-85025?

1) Patch Langflow to the fixed release above 1.11.5 as soon as IBM/Langflow publishes it — track the linked advisory for the exact version. 2) Until patched, disable public sharing on any Langflow flow/project exposed via MCP endpoints, or take internet-facing Langflow instances offline / behind authentication (VPN, reverse-proxy auth, IP allowlist). 3) Audit which flows are currently marked public and rotate any credentials or API keys embedded in those flows, since they may already be exposed. 4) Monitor Langflow host logs for anomalous process execution, unexpected outbound connections, or session access patterns inconsistent with normal per-user boundaries. 5) Restrict network exposure so Langflow MCP endpoints are never directly reachable from the public internet without an additional auth layer.

What systems are affected by CVE-2026-85025?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool/server integrations, RAG pipelines, multi-tenant AI orchestration platforms.

What is the CVSS score for CVE-2026-85025?

CVE-2026-85025 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool/server integrationsRAG pipelinesmulti-tenant AI orchestration platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0092 Manipulate User LLM Chat History

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM02:2025, LLM06:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

Exploitation Scenario

An attacker scans the internet (e.g., via Shodan/Censys-style reconnaissance) for exposed Langflow instances and identifies one with a publicly shared flow exposed through an MCP project endpoint. Without needing any credentials, they send a crafted request to the endpoint that abuses the missing authorization/session-isolation checks (CWE-863) to achieve arbitrary code execution on the underlying host. From there they pivot to read and modify other tenants' chat sessions on the same instance — harvesting proprietary prompts, RAG context, or embedded secrets — and use the code-execution foothold to move laterally into the hosting environment or exfiltrate data via standard C2 channels.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.