Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85025 2026-09-10

CVE-2026-85025: Unauthenticated RCE in IBM Langflow OSS via Public MCP Endpoints

"IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an authorization flaw (CVSS 9.8) that lets an unauthenticated attacker execute arbitrary code and read or modify chat sessions through publicly shared MCP project…"

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an authorization flaw (CVSS 9.8) that lets an unauthenticated attacker execute arbitrary code and read or modify chat sessions through publicly shared MCP project endpoints.

What Is It

The vulnerability stems from improper enforcement of public-flow security restrictions and session isolation controls in Langflow's publicly shared MCP project endpoints. IBM's PSIRT classifies it as CWE-863 (Incorrect Authorization). An attacker who can reach an exposed endpoint can execute arbitrary code and access or modify chat sessions belonging to other users.

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, and no user interaction required, with high impact across confidentiality, integrity, and availability.

Why It Matters

Arbitrary code execution without authentication on a network-facing service requires no prerequisites an attacker must first obtain. Langflow instances typically sit close to data pipelines, API credentials, and model integrations, so code execution on the host can extend to those adjacent systems. The session isolation failure adds a second impact: an attacker can read and tamper with other users' chat sessions, which may contain sensitive prompt content or business data.

The exposure is gated on whether MCP project endpoints are publicly shared. Any instance using that feature and reachable from an untrusted network should be treated as at risk.

What's Vulnerable

Patch Status

IBM published a security bulletin for this issue (support document node/7286666). The supplied NVD record was published 2026-09-10 and remains in "Awaiting Analysis" status, so no fixed version number is stated in the available data; consult the IBM bulletin for the remediation build. The affected range ends at 1.11.5, which indicates the fix lands in a later release.

No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation and no federal required-action deadline at this time.

Sources