CVE-2026-85025

9.8 criticalEPSS 0.6%

Critical (9.8) in langflow langflow. EPSS 0.6% chance of exploitation in the next 30 days.

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-11-01)
CWE: CWE-863
Published: 2026-09-10
Modified: 2026-09-15
Record from: the NVD, synced 2026-10-19

Affected

langflow:langflow

References

https://www.ibm.com/support/pages/node/7286666

Check your stack JSON