CVE-2026-17626: IBM Langflow Information Disclosure Flaw

CVE-2026-17626 Overview

CVE-2026-17626 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. The vulnerability allows an authenticated attacker to read, modify, or expose sensitive host files through Docker-based Model Context Protocol (MCP) servers. The root cause is incomplete filtering of dangerous Docker volume-mount and device-mapping arguments. This flaw is categorized under [CWE-266] (Incorrect Privilege Assignment). Successful exploitation grants access to files on the underlying container host, breaking the isolation boundary between the Langflow application and its host operating system.

Critical Impact
An authenticated attacker can escape container boundaries via Docker-based MCP servers to read or modify sensitive host files, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.3
Deployments using Docker-based MCP servers
Environments where Langflow has Docker socket or daemon access

Discovery Timeline

2026-08-05 - CVE-2026-17626 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-17626

Vulnerability Analysis

Langflow supports MCP servers that run as Docker containers to extend workflow capabilities. When users configure these MCP servers, Langflow accepts container launch arguments including volume mounts (-v) and device mappings (--device). The affected versions apply filtering to these arguments but the filter set is incomplete. An authenticated user can craft arguments that bypass the filter and instruct the Docker daemon to bind sensitive host paths into the container. Once mounted, the attacker reads or writes host files with the privileges of the Docker daemon, which is typically root.

Root Cause

The underlying weakness is [CWE-266] Incorrect Privilege Assignment. Langflow trusts authenticated users to supply Docker arguments, then delegates enforcement to a denylist that misses variant syntaxes. Docker supports multiple argument formats for volume and device specifications, and any missed form provides a path around the filter. The design assumes filter completeness rather than restricting Docker argument syntax to a small allowlist.

Attack Vector

The attacker must first authenticate to Langflow with permission to configure MCP servers. From there, the attacker submits a Docker-based MCP server definition containing volume-mount or device-mapping arguments that the filter fails to reject. When Langflow launches the container, the malicious mount or device becomes active. Sensitive host paths such as /etc, /root, /var/run/docker.sock, or block devices become accessible inside the container. Mounting the Docker socket itself escalates to full host takeover by launching further privileged containers.

Refer to the IBM Support Page for the vendor's technical description and fixed versions.

Detection Methods for CVE-2026-17626

Indicators of Compromise

Docker containers launched by Langflow with bind mounts to host paths such as /etc, /root, /var/run/docker.sock, or /proc
MCP server configurations containing --device, --privileged, or -v arguments referencing host system paths
Unexpected read or write access to sensitive host files originating from container processes spawned by the Langflow user
New or modified files under host directories following MCP server creation events in Langflow audit logs

Detection Strategies

Inspect Docker daemon logs and docker inspect output for containers spawned by Langflow that include suspicious HostConfig.Binds or HostConfig.Devices entries
Audit Langflow MCP server configurations in the database for Docker argument fields containing volume or device flags
Alert on any container process accessing files outside its expected working directory, particularly under /etc, /root, or Docker runtime sockets

Monitoring Recommendations

Enable Docker daemon audit logging and forward events to a central SIEM for correlation with Langflow user activity
Monitor file integrity on sensitive host paths that should never be modified by container workloads
Track creation and modification of MCP server entries within Langflow, correlating the acting user with subsequent container launches

How to Mitigate CVE-2026-17626

Immediate Actions Required

Upgrade IBM Langflow OSS to a version above 1.10.3 that contains the complete argument filter
Restrict MCP server configuration permissions to trusted administrators only until patched
Remove Docker socket access (/var/run/docker.sock) from the Langflow runtime environment where feasible
Review existing MCP server definitions for unauthorized volume or device arguments and remove any suspicious entries

Patch Information

IBM has published remediation guidance on the IBM Support Page. Apply the fixed release identified in the advisory. Versions 1.0.0 through 1.10.3 remain vulnerable.

Workarounds

Run Langflow under a non-root user without membership in the docker group to prevent container launches with host-level privileges
Deploy Langflow behind an authentication proxy and enforce role-based access controls that block untrusted users from MCP server management
Use a Docker security profile such as seccomp, AppArmor, or user namespace remapping to limit the impact of malicious mount arguments
Disable Docker-based MCP server support if it is not required for production workflows

bash

# Configuration example: restrict Langflow container from launching sibling containers
# Remove Docker socket mount and drop unnecessary capabilities
docker run \
  --user 1000:1000 \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  --read-only \
  -p 7860:7860 \
  langflowai/langflow:latest