CVE-2026-110186 · IBM Langflow OSS unauthenticated code injection via MCP tool…

01 · The Real Story

A public-facing AI workshop where anyone can swap the blueprints and run their own code on the server

Langflow is an open-source visual builder for AI agents and retrieval-augmented generation (RAG) workflows. CVE-2026-110186 affects Langflow OSS versions 1.0.0 through 1.12.8. The flaw allows an unauthenticated remote attacker to abuse the Model Context Protocol (MCP) tool enumeration path, causing the backend to generate and execute attacker-controlled code without proper validation. The result is arbitrary code execution in the context of the Langflow service account.

IBM's 9.8 CVSS score is technically justified: network attack vector, no privileges, no user interaction, full confidentiality/integrity/availability impact. In practice, however, Langflow is typically an internal development or line-of-business service, not an internet-facing asset. The reachable attack surface is much smaller than the CVSS metrics suggest, but this remains a high-priority internal-network RCE.

"Unauthenticated RCE in Langflow 1.0.0–1.12.8 via MCP tool enumeration; patch to 1.13.0 fast, but exposure is mostly internal."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Identify a reachable Langflow instance

The attacker scans internal networks or the public internet for Langflow's web UI/API endpoints. Common discovery methods include Shodan/Censys for public exposure, or internal port scans for self-hosted AI tooling. A vulnerable instance answers HTTP requests with Langflow-specific paths or banners.

Conditions required:

Network route from attacker to Langflow HTTP endpoint

Where this breaks in practice:

Langflow is rarely exposed publicly; most instances sit on internal development subnets

Detection/coverage: External scanners such as Shodan/Censys can identify internet-facing instances; internal vulnerability scanners can flag the service.

STEP 02

Reach the MCP tool enumeration endpoint without authentication

The vulnerable code path exposes MCP tool enumeration or code generation without requiring prior authentication. A simple unauthenticated HTTP request to the relevant endpoint returns available tools and parameters. This is the entry point for code injection.

Conditions required:

Default or misconfigured authentication on the Langflow instance

Where this breaks in practice:

A reverse proxy or WAF enforcing authentication in front of Langflow can block this step

Detection/coverage: Web access logs and WAF logs may show unauthenticated requests to MCP-related paths.

STEP 03

Inject code through tool parameters or generated code paths

The attacker crafts a request or tool invocation that causes Langflow's code-generation component to emit arbitrary Python or JavaScript. Because the generator does not sandbox or validate generated code, the emitted code executes on the server. This does not require a separate memory-corruption primitive.

Conditions required:

Langflow instance has vulnerable code-generation or MCP tool execution components enabled

Where this breaks in practice:

Some deployments may not load the affected code-generation component if it is disabled or unused

Detection/coverage: EDR / process monitoring may catch unexpected child processes spawning from the Langflow service.

STEP 04

Achieve command execution as the Langflow service account

The injected code executes with the privileges of the Langflow process, typically a dedicated user or container service account. The attacker obtains an interactive command shell or a file-write primitive. This establishes a foothold on the host.

Conditions required:

Successful injection and execution of attacker-controlled code

Where this breaks in practice:

Properly configured container isolation or a low-privileged service account can limit post-exploitation impact

Detection/coverage: Container runtime alerts, host process monitoring, and EDR behavioral detection.

STEP 05

Pivot via connected LLM API keys and internal data sources

Langflow workflows often store API keys, vector database connection strings, and document retrieval paths. An attacker who compromises the service can extract these credentials, access internal systems such as LLM APIs or document stores, and exfiltrate sensitive data or move laterally.

Conditions required:

Langflow configured with external services, API keys, or connected data sources

Where this breaks in practice:

Least-privilege credentials and network segmentation can reduce the blast radius

Detection/coverage: SIEM correlation of anomalous Langflow service account access and outbound data flows.

03 · Compensating Control

HIGH 8.2→IGNORE 0.0

SEVERITY REDUCED

Upgrade Langflow OSS to 1.13.0 or later — Primary remediation; deploy within the noisgate mitigation SLA of 30 days for HIGH and full remediation within 180 days. The fix removes the code-generation injection path.

HIGH 8.2→MEDIUM 5.0

SEVERITY REDUCED

Segment Langflow away from public/internet access and enforce boundary controls — Reduce attack surface while patch is scheduled; apply within 30 days. This forces attackers into an internal network position, removing unauthenticated internet exploit.

HIGH 8.2→MEDIUM 4.0

SEVERITY REDUCED

Disable or restrict MCP tool enumeration and code execution components if not required — Removes the vulnerable code path for many deployments; review Langflow configuration and disable unused code generation or MCP features.

HIGH 8.2→HIGH 7.5

Enable process-level monitoring and alerting for the Langflow service account — Detect post-exploitation activity such as unexpected shell spawns, credential access, or outbound connections; does not prevent exploitation but enables rapid response.

What doesn't work

Disabling LANGFLOW_AUTO_LOGIN alone does not mitigate this CVE; the code injection is independent of the auto-login bypass.
A WAF in front of the UI may not parse or block MCP tool payloads unless custom rules are written.
Running Langflow in Docker does not prevent host impact if volumes or API credentials are mounted.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No active exploitation reported; CISA KEV not listed.
PoC availability	No public PoC identified in reviewed sources; CVE is newly published.
EPSS	0.00622 (0.6%) — low predicted immediate exploitation probability.
KEV	Not listed in CISA KEV.
CVSS	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical.
Affected versions	Langflow OSS 1.0.0 through 1.12.8; fixed in 1.13.0.
Exposure data	No GreyNoise/Shodan/Censys mass-exploitation data specific to this CVE yet; Langflow is typically internal.
Disclosure	2026-10-29 (NVD); IBM advisory published 2026-10-28.
Reporter	IBM PSIRT.
CWE	CWE-94: Improper Control of Generation of Code ('Code Injection').

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to HIGH (8.2/10)

Why this verdict

Baseline: Unauthenticated RCE with CVSS 9.8 is technically correct; the vulnerable code path requires no privileges or user interaction.
Friction: Langflow is rarely internet-exposed; most deployments sit on internal AI/ML subnets, so the reachable population is a fraction of the installed base. EPSS 0.00622 and no KEV/no public PoC further indicate no imminent mass exploitation.
Role multiplier: Typical high-value deployments are internal workflow builders with access to LLM API keys, vector DBs, and document stores. A successful exploit yields host compromise and data egress/pivot, but not domain/fleet/hypervisor-scale impact; that caps the verdict at HIGH rather than CRITICAL.

Why not higher?

Not CRITICAL because Langflow is not a canonical high-value-role component (not an IdP, hypervisor, PAM, edge, or CI/CD control plane), and there is no evidence of internet-scale exposure or active exploitation. The typical compromised instance gives a single app-tier host, not fleet-wide or domain takeover.

Why not lower?

Cannot go below HIGH because an unauthenticated, no-user-interaction RCE in an internal AI workflow server has immediate event escalation potential and access to sensitive API keys/data. Once an attacker has any internal network foothold, this becomes a convenient pivot.

06 · Verification

Crowdsourced verification payload.

Run on any host where Langflow is installed via pip or accessible Python environment; requires only local read access to package metadata. Example invocation: python3 check_cve_2026_110186.py. Outputs VULNERABLE, PATCHED, or UNKNOWN.

noisgate-verify.py

PYTHONREAD-ONLYSAFE

#!/usr/bin/env python3
"""Check Langflow version for CVE-2026-110186 vulnerability."""
import sys

try:
    from importlib.metadata import version
    installed = version('langflow')
except Exception:
    try:
        import pkg_resources
        installed = pkg_resources.get_distribution('langflow').version
    except Exception:
        print('UNKNOWN: langflow not installed or not importable')
        sys.exit(2)

def parse(v):
    parts = v.split('.')[:3]
    return tuple(int(x) for x in parts)

try:
    iv = parse(installed)
    vuln_min = (1,0,0)
    vuln_max = (1,12,8)
    patch = (1,13,0)
    if vuln_min <= iv <= vuln_max:
        print(f'VULNERABLE: langflow {installed} is in affected range')
        sys.exit(1)
    elif iv >= patch:
        print(f'PATCHED: langflow {installed} is >= 1.13.0')
        sys.exit(0)
    else:
        print(f'UNKNOWN: langflow {installed} not classified')
        sys.exit(2)
except Exception as e:
    print(f'UNKNOWN: cannot parse version {installed}: {e}')
    sys.exit(2)