CVE-2026-17630: High Config Validation Code Execution in Langflow

CVE-2026-17630 is a flaw in Langflow OSS 1.0.0 through 1.10.3 where improper validation of configuration parameters, through an incomplete list of disallowed inputs, could let an attacker execute arbitrary code. It scores 7.2, High. IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workaround.

What's affected

Langflow OSS 1.0.0 through 1.10.3, per IBM's bulletin, on Linux, macOS and Windows.

IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workarounds or mitigations. The bulletin (node 7282147) was last modified on 24 August 2026 and first published on 31 July 2026. It sits in the bulletin on Langflow's Model Context Protocol (MCP) features.

The record scores it 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The record's text says a remote attacker without the word authenticated, while the vector requires high privileges (PR:H). Reading the vector, the attacker needs an account with elevated rights, so this is not an anonymous attack.

How to check if you're exposed

Check the installed Langflow version in each environment where you run it: laptops, notebooks, containers and servers.

pip show langflow
pip list | grep -i langflow
docker image ls | grep -i langflow

The first two show the Python package version, and the third lists local container images so you can see the tags. Anything from 1.0.0 to 1.10.3 is in range. Also look in requirements.txt, pyproject.toml and lock files, because a pinned version in a repository will bring the problem back the next time someone rebuilds. Then look at who can change configuration on your instance, because the vector asks for high privileges.

What to do now

1. Find every Langflow install and record its version.
2. Upgrade to Langflow OSS 1.11.0 or newer.
3. List who can change MCP and project configuration, and limit it to administrators.
4. Review current configuration values for anything unfamiliar.
5. Langflow can run user-supplied Python and connects to external tools, so keep instances off the open internet and behind authentication, and run it as a low-privilege user with limited network access.

Why it matters

The record classes the weakness as CWE-184, Incomplete List of Disallowed Inputs. The weakness class gives the story away. The record classes it as CWE-184, incomplete list of disallowed inputs. That is the block list problem: the code keeps a list of dangerous values and refuses them, but the list misses something, and the missing item is dangerous too.

Block lists are fragile in configuration handling. Command lines and flags have many spellings and many ways to combine, so a list that covers the obvious ones leaves gaps. The safer design is an allow list, where only known good values pass. IBM's bulletin hints at the same pattern elsewhere. Another CVE in it is about incomplete filtering of Docker volume and device arguments, and another about a missing check of the command field in MCP server settings.

For defenders, this means upgrading and not trying to patch around individual values. It also means limiting who can change configuration, because every one of these issues needs someone who can. The bulletin lists seven CVEs and this one scores 7.2. The record does not report exploitation, and the CVE is not in the CISA catalog.

Quick check

Sources

• IBM Security Bulletin 7282147: Langflow MCP features, fetched 18 October 2026

Last reviewed: 18 October 2026.