CVE-2026-7755: Langflow Langflow RCE Vulnerability

CVE-2026-7755 Overview

CVE-2026-7755 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability allows remote code execution due to incomplete validation enforcement on Model Context Protocol (MCP) server configuration files. Authenticated attackers can leverage this weakness to run arbitrary code on hosts running Langflow. The flaw is tracked under CWE-20: Improper Input Validation and carries a CVSS 3.1 base score of 8.8.

Critical Impact
Authenticated network attackers can execute arbitrary code on Langflow hosts by supplying crafted MCP server configuration files, compromising confidentiality, integrity, and availability.

Affected Products

Langflow Langflow OSS versions 1.0.0 through 1.10.0
Deployments on Apple macOS
Deployments on Linux and Microsoft Windows

Discovery Timeline

2026-07-17 - CVE-2026-7755 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-7755

Vulnerability Analysis

Langflow is an open-source framework for building agentic and retrieval-augmented generation (RAG) applications. It integrates with external tools through the Model Context Protocol (MCP), which uses server configuration files to describe how Langflow should connect to and invoke MCP servers. CVE-2026-7755 stems from incomplete validation of the fields within these MCP server configuration files.

An authenticated attacker with permission to submit or modify MCP server configuration entries can supply values that Langflow forwards to underlying process execution or resource-loading routines. Because validation does not fully constrain command paths, arguments, or transport parameters, the crafted configuration triggers execution of attacker-controlled code in the context of the Langflow service.

The issue is exploitable over the network with low attack complexity and low privileges, and it does not require user interaction. Successful exploitation grants the attacker the same operating system privileges as the Langflow process, which typically has access to model API keys, connected data sources, and any tools registered with the platform.

Root Cause

The root cause is improper input validation ([CWE-20]) on MCP server configuration files. Langflow accepts configuration input but does not fully enforce allow-lists, path restrictions, or argument sanitization before the values are used to spawn MCP server processes or load remote resources.

Attack Vector

Exploitation requires network access to a Langflow instance and a valid authenticated session. The attacker submits a malicious MCP server configuration through the Langflow interface or API. When Langflow processes the configuration and instantiates the MCP server, the unsanitized fields cause execution of attacker-specified binaries or code. Public proof-of-concept code was not available at the time of publication, and the EPSS score sits at 0.415%.

No verified exploit code is available. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-7755

Indicators of Compromise

Unexpected child processes spawned by the Langflow service, especially shells, interpreters, or network utilities such as bash, python, curl, or powershell.exe.
Newly created or modified MCP server configuration entries containing unusual command paths, arguments, or references to remote scripts.
Outbound network connections from the Langflow host to unrecognized domains shortly after MCP configuration changes.

Detection Strategies

Audit Langflow application logs for MCP server registration and update events, correlating them with process creation events on the host.
Baseline the legitimate set of MCP servers used in production and alert on deviations from the approved list.
Monitor for Langflow processes writing to sensitive locations such as /etc, ~/.ssh, or Windows autorun registry keys.

Monitoring Recommendations

Forward Langflow container and host telemetry to a centralized logging platform, including process, file, and network events.
Enable authentication logging for the Langflow API and track configuration changes by user and source IP address.
Alert on any interactive shells or reverse-shell patterns originating from the Langflow service account.

How to Mitigate CVE-2026-7755

Immediate Actions Required

Upgrade Langflow OSS to a fixed release above version 1.10.0 as identified in the IBM Support Page.
Restrict network access to Langflow instances so that only trusted users on trusted networks can reach the API and UI.
Review existing MCP server configurations and remove any entries that were not created by authorized administrators.

Patch Information

IBM has published guidance for CVE-2026-7755 on the IBM Support Page. Administrators running Langflow OSS 1.0.0 through 1.10.0 should follow the vendor advisory to apply the fixed release and verify the deployed version after upgrade.

Workarounds

Enforce least privilege on Langflow accounts and disable self-service creation of MCP server configurations for non-administrative users.
Run Langflow in a hardened container with a read-only root filesystem, a non-root user, and outbound network egress restricted to required endpoints.
Place Langflow behind an authenticating reverse proxy and require multi-factor authentication for all users who can modify configurations.

bash

# Example: run Langflow container with reduced privileges and restricted egress
docker run -d \
  --name langflow \
  --read-only \
  --user 10001:10001 \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --network langflow-restricted \
  -p 127.0.0.1:7860:7860 \
  langflowai/langflow:latest