CVE-2026-85025: Langflow before 1.11.6 has 11 code-execution bugs, including unauthenticated RCE through shared MCP projects

What it is

CVE-2026-85025: publicly shared MCP project transports and public flows with MCP Tools components skip the public-flow code-execution guard and session scoping, so anonymous callers can execute code and tamper with chat sessions.

CVE-2026-79724 (OS command injection, CVSS 9.8) and CVE-2026-81204 (code injection during graph construction): remote code execution in Langflow OSS.

Authenticated paths to code execution: custom components in stored flows skip the admin-only policy (CVE-2026-81211), a non-admin can build a flow that runs OS commands (CVE-2026-81941), flow display names aren't neutralized (CVE-2026-81940), the security scanner's denylist is incomplete or can be bypassed with annotated class-body assignments (CVE-2026-78569, CVE-2026-76059), and the lfx CodeParser passes annotation source to eval() (CVE-2026-78571).

MCP stdio server configuration: on Windows only one cmd.exe switch is recognized, so others bypass the allow-list (CVE-2026-78575), and OPENSSL_CONF is missing from the environment blocklist, which allows native code loading (CVE-2026-79742).

How to check

1. Affected: Langflow OSS 1.0.0 through 1.11.5.
2. You are most exposed if you share MCP projects or flows publicly, or let users you don't fully trust log in.

How to fix

1. Upgrade Langflow to 1.11.6 or later. IBM lists no workarounds.
2. Until you upgrade, stop sharing MCP projects and public flows and keep the instance off the public internet.

pip show langflow | grep -i version

Sources

• IBM security bulletin (node 7286666) ↗
• NVD: CVE-2026-85025 ↗
• NVD: CVE-2026-81204 ↗