CVE-2026-17625 is an OS command injection flaw in Langflow OSS 1.0.0 through 1.10.3, in features that manage Model Context Protocol connections. A remote authenticated attacker could run arbitrary commands. It scores 7.2, High. IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workaround.
What's affected
Langflow OSS 1.0.0 through 1.10.3, per IBM's bulletin, on Linux, macOS and Windows.
IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workarounds or mitigations. The bulletin (node 7282147) was last modified on 24 August 2026 and first published on 31 July 2026. The NVD text repeats the version range several times, which looks like a data glitch; the range is simply 1.0.0 to 1.10.3. The bulletin concerns Langflow's Model Context Protocol (MCP) features and lists seven CVEs.
The record scores it 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vector is network access, low complexity, high privileges required and unchanged scope, with high impact on all three properties. One quirk: IBM's page prints the vector line twice for this CVE. It is the same vector twice, and the score is 7.2 in both places.
How to check if you're exposed
Check the installed Langflow version in each environment where you run it: laptops, notebooks, containers and servers.
pip show langflow
pip list | grep -i langflow
docker image ls | grep -i langflow
The first two show the Python package version, and the third lists local container images so you can see the tags. Anything from 1.0.0 to 1.10.3 is in range. Also look in requirements.txt, pyproject.toml and lock files, because a pinned version in a repository will bring the problem back the next time someone rebuilds. Also check the settings of MCP server connections on your instance. The bulletin says weaknesses in MCP command and configuration validation are involved.
What to do now
- Find every Langflow install and record its version.
- Upgrade to Langflow OSS 1.11.0 or newer.
- Review MCP server entries and project settings on each instance, and remove any you do not recognise.
- Restrict who can create or change MCP server configurations. The vector asks for high privileges, so this is mainly about administrators and trusted users.
- Langflow can run user-supplied Python and connects to external tools, so keep instances off the open internet and behind authentication, and run it as a low-privilege user with limited network access.
Why it matters
The record classes the weakness as CWE-78, OS Command Injection. Model Context Protocol servers let AI applications connect to tools. In Langflow that often means launching a local command to start an MCP server. Launching commands from configuration is exactly where input validation has to be strict: a value that the system treats as a command to run is a short step from running whatever someone put there.
IBM's summary of the bulletin says weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling and request trust logic could allow unauthorised access, unsafe configuration changes, unintended code retrieval or arbitrary command execution in the Langflow server context. This CVE is the OS command injection item, which the record classes as CWE-78.
The high privileges requirement keeps the score at 7.2. Still, in many teams the people who can edit MCP settings are not the same people who can administer the server. A bug that turns settings access into command execution blurs that line. The same bulletin includes one issue whose description says no credentials are needed, so do not treat the whole group as authenticated only. This CVE is not reported as exploited and is not in the CISA catalog.
Try it yourself
Command injection is a classic finding for static analysis. This demo shows a code scan flagging a command built from untrusted input, and what a fix looks like.
Click through it at your own pace, or open it full screen.
Quick check
Is the attacker authenticated?
IBM describes a remote authenticated attacker, and the vector requires high privileges.
Which feature is involved?
IBM's bulletin ties this group of CVEs to Langflow's Model Context Protocol features.
Sources
- IBM Security Bulletin 7282147: Langflow MCP features, fetched 18 October 2026
Last reviewed: 18 October 2026.
