---
id: CVE-2026-81941
title: >-
  IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated
  non-administrative user could execute arbitrary operating system commands on
  the server at the privilege level of the application process by constructing a
  flow with an MCP To…
summary: >-
  IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated
  non-administrative user could execute arbitrary operating system commands on
  the server at the privilege level of the application process by constructing a
  flow with an MCP To…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-284
vendor: langflow
product: langflow
affected:
  - 'langflow >= 1.0.0, < 1.11.6'
patched:
  - langflow 1.11.6
published: '2026-09-10'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T00:59:19.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81941'
references:
  - url: 'https://www.ibm.com/support/pages/node/7286666'
    label: psirt@us.ibm.com
tags:
  - nvd
  - cve.org
epss: 0.00626
epssPercentile: 0.47789
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T00:00:00+00:00'
ingestedAt: '2026-09-14T15:23:07.483Z'
---

## Overview

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.

## Affected

- `langflow >= 1.0.0, < 1.11.6`

## Remediation

Upgrade past the affected range:

- `langflow 1.11.6`