Description

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-10T21:17:51.990Z",
  "pubdate": "2026-09-10T21:17:51.990Z",
  "executiveSummary": "IBM Langflow versions 1.0.0 through 1.11.5 contain a critical vulnerability related to improper enforcement of security restrictions on public Model Context Protocol (MCP) project endpoints.\nThe vulnerability allows an unauthenticated, remote attacker to bypass intended access controls, leading to arbitrary code execution and unauthorized access or modification of sensitive chat sessions.\nThis flaw stems from a failure in session isolation and public-flow security mechanisms, permitting unauthorized interaction with backend processes.\nThe risk is classified as critical, as it grants attackers the ability to perform operations equivalent to the application's service account, potentially leading to full system compromise.\nExploitation does not require prior authentication, making the exposed endpoints highly susceptible to automated or manual attacks if accessible over a network.",
  "technicalDetails": "The vulnerability resides within the handling of MCP (Model Context Protocol) project endpoints in IBM Langflow versions 1.0.0 through 1.11.5. These endpoints are designed to facilitate interaction with external data sources or tools within a flow, but they fail to adequately validate the authorization context of requests directed toward publicly shared flows.\nThe root cause is an improper enforcement of public-flow security restrictions. While flows may be marked as 'public,' the underlying architecture fails to strictly enforce session isolation controls. When an unauthenticated user interacts with these MCP endpoints, the application fails to properly tokenize or verify the session scope, effectively allowing the execution of logic outside the boundaries defined for anonymous access.\nAttack flow involves the adversary identifying an exposed Langflow instance with publicly shared project endpoints. The attacker crafts a malicious request targeting the MCP integration point. Because the server-side logic does not properly sanitize or gate these requests based on session origin, the application processes the request using its internal execution context.\nBy manipulating the request parameters, an attacker can trigger the execution of arbitrary commands on the host server. Since the application handles backend logic for these flows, the code execution typically occurs with the privileges of the service account running the Langflow process.\nFurthermore, the lack of session isolation means that concurrently active chat sessions are not adequately protected. An attacker can access, inject into, or modify chat state data by navigating the unprotected MCP pathways, leading to full compromise of the integrity and confidentiality of the chat data flow.\nThis vulnerability essentially collapses the distinction between authenticated user sessions and unauthenticated public endpoints, allowing an external entity to perform arbitrary backend operations, including systemic modifications or the execution of system-level shell commands, depending on the environment configuration."
}