CRITICAL 9.8 NVD

CVE-2026-85025

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publ

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

References

https://www.ibm.com/support/pages/node/7286666

Published: 2026-09-10 · Source: NVD · Feed updated: 2026-09-11

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-09-10 via NVD.

Risk Timeline

CVE Disclosed2026-09-10 · 0 days ago

Remediation Resources

Analysis & PoC

www.ibm.com/support/pages/node/7286666

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.