Five flaws disclosed in IBM Langflow OSS agent builder

Five security advisories covering IBM Langflow OSS, a visual tool for building AI agent and LLM workflows, were published in the GitHub Advisory Database on 11 September 2026. All affect versions 1.0.0 through 1.11.5, apart from one that affects 1.0.0 through 1.10.3. Between them, the advisories describe remote authenticated attackers executing arbitrary Python code, running operating system commands on the host, and obtaining sensitive information.

The most detailed of the five is CVE-2026-81941. According to the advisory, an authenticated non-administrative user can execute arbitrary operating system commands on the server at the privilege level of the application process by building a flow with an MCP Tools component configured to use a local stdio subprocess transport. MCP, the Model Context Protocol, is the interface agents use to call external tools; a stdio transport launches that tool as a local subprocess.

The advisory states that this route bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls, which are the settings intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, exposure of sensitive data including credentials held in the process environment, file system modification, and lateral movement to other services reachable from the server, according to the same advisory.

A second issue, CVE-2026-81211, concerns improper authorisation of custom components in stored flows. The advisory says this could allow a remote authenticated attacker to execute arbitrary Python code. Custom components are user-supplied code blocks that Langflow runs as part of a flow, so an authorisation gap around them removes a significant barrier between an ordinary account and code execution.

A third, CVE-2026-81268, is an identity problem rather than a code execution one. The advisory says API keys are not expired properly after a user is deactivated, which could allow a remote authenticated attacker to keep executing flows and obtain sensitive information. In practice that means revoking a person's account may not revoke the machine credentials issued to it, an issue that matters more in agent platforms where long-lived keys are the normal way of triggering automated work.

The fourth, CVE-2026-84889, affects the narrower range of 1.0.0 through 1.10.3 and is described as allowing a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory — a path traversal weakness. The fifth advisory, CVE-2026-81265, is listed against IBM Langflow OSS 1.0.0 through 1.11.5 without a further description of the weakness in the published record.

The advisories are attributed to IBM, which publishes Langflow OSS. The records seen do not state a fixed version, do not indicate whether patches are available, and do not report any exploitation in the wild. They also give no discovery credit or timeline beyond the 11 September 2026 publication date.

The common thread across four of the five entries is that a logged-in, non-administrative user is enough. Langflow deployments that hand accounts to a broad set of internal builders, or that expose a shared instance across teams, therefore inherit a wide blast radius from an ordinary account. Operators should check which version they are running against the affected ranges listed in the advisories.