CVE-2026-85025: Langflow MCP Endpoint Flaw Enables Unauthenticated RCE

Overview

A critical vulnerability has been disclosed in Langflow, the open-source visual framework widely used for building and deploying large language model (LLM) applications and agentic workflows. Tracked as CVE-2026-85025, the flaw carries a CVSS score of 9.8 (Critical) and allows an unauthenticated attacker to execute arbitrary code and access or modify other users' chat sessions through publicly shared Model Context Protocol (MCP) project endpoints.

The vulnerability affects Langflow OSS versions 1.0.0 through 1.11.5 and stems from improper enforcement of public-flow security restrictions combined with weak session isolation controls.

Technical Details

How It Works

Langflow allows project owners to publicly share individual flows so external callers can invoke them through MCP-compatible endpoints without logging into the Langflow instance. CVE-2026-85025 exists because the code responsible for handling these public MCP endpoints does not correctly enforce the security restrictions meant to keep public flows isolated from the rest of the deployment.

An unauthenticated caller can reach these endpoints directly and, due to the improper session isolation, both execute arbitrary code on the host and read or modify chat session state belonging to other users — effectively bypassing the entire authentication boundary Langflow relies on for anything marked "public."

This is not Langflow's first brush with critical unauthenticated RCE. Earlier 2026 flaws — CVE-2025-3248 (unauthenticated RCE via code validation) and CVE-2026-5027 (path traversal leading to RCE) — were both actively exploited shortly after disclosure, underscoring that Langflow deployments are a recurring target given their prevalence in AI/agent pipelines.

Impact Assessment

Who Is At Risk

Any organization running a Langflow OSS instance between v1.0.0 and v1.11.5 with publicly shared flows or MCP project endpoints exposed to untrusted networks is at risk. This includes:

• Internet-facing Langflow deployments used for internal AI tooling demos or partner integrations
• Multi-tenant Langflow instances where "public" flows are used to expose specific automations
• Any deployment where MCP endpoints are reachable without a network-level access control layer in front of them

Potential Attack Chains

1. Discovery — Attacker enumerates or guesses publicly shared MCP project endpoints
2. Unauthenticated Access — Broken isolation lets the attacker reach flow execution logic without credentials
3. Arbitrary Code Execution — Attacker executes code in the context of the Langflow server process
4. Session Tampering — Attacker reads or modifies other users' chat sessions, potentially exfiltrating conversation data, prompts, or connected credentials

Mitigation

Immediate Actions

• Upgrade to a Langflow release later than v1.11.5, where public-flow restrictions and session isolation have been hardened
• Restrict network access to MCP endpoints — limit public-facing flows to trusted IP ranges or internal networks only
• Audit existing deployments for signs of unauthorized session activity or unexpected process execution
• Rotate any credentials that may have been reachable from the Langflow server's execution context, including API keys wired into connected flows

Detection Opportunities

• Unexpected outbound connections or process spawning from the Langflow server process
• Requests to MCP project endpoints from unfamiliar source IPs with no corresponding authenticated session
• Anomalies in chat session data — messages or state changes not attributable to the legitimate session owner

Defence-in-Depth

• Avoid exposing Langflow's MCP endpoints directly to the internet; front them with an authenticating reverse proxy or VPN
• Run Langflow under a least-privilege service account
• Enable logging and alerting on public-flow invocations

Background: Langflow as a Target

Langflow's rapid adoption for building LLM-powered agents and automations has made it an attractive target — a foothold on a Langflow server often provides access to connected model providers, vector stores, and downstream integrations. Given the pattern of repeated critical, pre-auth RCE disclosures in Langflow through 2025 and 2026, teams running self-hosted instances should treat patching as high priority and assume scanning for this flaw is already underway.

References

• NVD — CVE-2026-85025
• The Hacker News — Langflow Vulnerability Exploited for Unauthenticated RCE
• Cloud Security Alliance — Langflow Path Traversal Research Note