CVE-2026-85025

Executive Summary

CVE-2026-85025 is a critical (CVSS 9.8) authorization and isolation failure in the IBM Langflow OSS low-code LLM application builder, affecting versions 1.0.0 through 1.11.5. An unauthenticated, remote attacker can exploit publicly shared MCP (Model Context Protocol) project endpoints to execute arbitrary code and read or modify other users' chat sessions, because public-flow security restrictions and session isolation controls are not properly enforced. Any internet-exposed Langflow instance in the affected version range should be considered fully compromiseable.

Technical Analysis

This finding is classified as CWE-863 (Incorrect Authorization). The root defect is not a memory-safety bug or an injection flaw — it is a failure to enforce access-control and tenant-isolation boundaries on a specific class of endpoint. The NVD description states that the issue arises through "publicly shared MCP project endpoints," and that the underlying cause is "improper enforcement of public-flow security restrictions and session isolation controls."

Two distinct control failures are described:

1. Public-flow security restrictions are not enforced. Langflow supports the concept of "flows" that can be shared publicly. The vulnerability indicates that endpoints reachable for a public flow are not confined to the intended read-only/limited surface. A request that should be rejected (because it originates unauthenticated or belongs to a non-owner) is instead accepted, allowing reach-through to functionality that grants code execution.

2. Session isolation controls are not enforced. Chat sessions belonging to one user/tenant are not properly segregated. Combined with the public endpoint exposure, an unauthenticated party can access or modify sessions that do not belong to them, breaking confidentiality and integrity of conversation data.

The authentication model required is PR:N (no privileges) and the attack is network-reachable (AV:N) with no user interaction (UI:N). This is the canonical signature of authorization logic that is checked on one code path (e.g., the UI) but omitted on a parallel API path. The MCP endpoint class is reachable without authentication by design in the "public share" use case, and the defect is that the authorization boundary for that public surface is drawn too permissively.

Code-level specifics are not available. The provided intelligence contains no function names, class names, URL paths, or parameter names. We therefore describe the mechanism at the vulnerability-class level only. Analysts should NOT assume any particular endpoint string; discovery should be done by enumerating the deployment's own MCP endpoints.

The "arbitrary code execution" consequence in a Langflow context is consistent with the product's core function: flows define executable components, and a builder that executes user-defined chains will execute code if an attacker can reach flow-execution functionality without authorization. The precise execution primitive is not specified in the source data.

Exploitation Scenarios

No public PoC or exploit code is available. The following chain is inferred from the vulnerability class (CWE-863 on public MCP endpoints) and the NVD description; it deliberately avoids inventing endpoint names or parameters.

1. Reconnaissance / target identification. The attacker scans for internet-exposed Langflow instances, for example using Shodan queries such as http.title:"Langflow" or http.html:"Langflow", and confirms the target is running a version in the 1.0.0–1.11.5 range. Publicly shared project or MCP endpoints advertise themselves as anonymous-access surfaces, so no credentials are needed to begin probing.

2. Triggering the flaw class. The attacker interacts with the publicly reachable MCP project endpoint. The intended behavior of a public share is a constrained, read-limited interaction. Because "public-flow security restrictions" are improperly enforced, the attacker's request is accepted in a context where it should have been denied — i.e., the request executes with more authority than the share grant should permit. This is the incorrect-authorization trigger: no privilege escalation step is performed by the attacker; the server simply fails to enforce the boundary.

3. Execution at the vulnerability-class level. From the incorrectly authorized context, the attacker reaches flow-execution functionality. In a Langflow deployment, flow components can perform code execution as part of normal operation; if an attacker can invoke or supply such execution without authorization, this yields arbitrary code execution in the Langflow process context. The specific invocation mechanism is not documented in the source data and must be determined by testing against a lab instance.

4. Post-exploitation impact. The attacker can (a) read and modify chat sessions belonging to other users, violating session isolation; and (b) execute arbitrary code, which in a Langflow deployment typically means control over the application server's process, access to stored API keys/secrets, access to connected LLM provider credentials, and pivot into any backend systems the flows can reach. The 9.8 score reflects high confidentiality, integrity, and availability impact with no required privileges or user interaction.

Caveat: because no PoC exists, steps 2 and 3 describe the general exploitation pattern for an unauthenticated authorization-bypass-to-RCE on a publicly exposed endpoint. Treat them as hypotheses to validate in a controlled lab, not as a reproducible exploit recipe.

Impact Assessment

• CVSS 3.1: 9.8 (Critical). Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • AV:N — the vulnerable MCP endpoints are network-reachable; no adjacent or local access is needed.
  • AC:L — no special conditions or race windows; the authorization check is simply absent on the reachable path.
  • PR:N — the attacker is unauthenticated. The "public share" design makes the entry point anonymous by definition.
  • UI:N — no victim action is required; the attacker does not need a user to click or approve anything.
  • S:U — impact is scored within the Langflow security authority; there is no formal scope change. In practice, arbitrary code execution on the host often crosses into broader infrastructure, but the vector scores it as unscoped.
  • C:H / I:H / A:H — full loss of confidentiality, integrity, and availability for the affected component.
• Blast radius. Any Langflow instance on 1.0.0 through 1.11.5 that is reachable from an untrusted network and exposes shared MCP projects. Langflow is frequently deployed as an internal or internet-facing tool by data science and AI engineering teams, and is often run with broad credentials (LLM API keys, database tokens) inside the same process — so a single RCE is high-leverage.
• EPSS 0.00430 (36.4th percentile). The current probability of exploitation within 30 days is estimated low in absolute terms, but this metric predates weaponization; a 9.8 unauthenticated RCE with a trivial entry point can spike quickly once a PoC is published. Do not let the low EPSS drive deprioritization.
• CISA KEV: NO. No federal mandate or confirmed in-the-wild exploitation at time of writing.
• Business impact. Chat-session leakage can expose proprietary prompts, retrieved RAG documents, and customer data; RCE can expose provider secrets and allow lateral movement.

Detection Guidance

Detection strategy: (a) find unauthenticated access to MCP/project endpoints in network or web logs, (b) detect anomalous process behavior consistent with code execution from the Langflow service. Because endpoint strings are not documented in the source data, rules below use generic patterns and must be tuned to your deployment's observed URL structure.

Sigma Rule

title: Langflow Public MCP Endpoint Access Without Authentication (CVE-2026-85025)
id: 9f2c1a44-7b3e-4c11-9a55-langflow85025
status: experimental
description: Detects unauthenticated requests to Langflow public MCP/project endpoints that may indicate exploitation of CVE-2026-85025.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85025
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: langflow
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/mcp'
      - '/api/v1/mcp'
      - '/public'
      - '/shared'
  selection_noauth:
    sc-status:
      - 200
      - 201
      - 202
  filter_known:
    cs-uri-stem|contains:
      - '/health'
      - '/static'
      - '/assets'
  condition: selection_path and selection_noauth and not filter_known
falsepositives:
  - Legitimate anonymous access to intentionally public flows
level: high
tags:
  - attack.t1190
  - cve.2026.85025
  - cwe.863

YARA Rule

rule CVE_2026_85025_Langflow_MCP_Authz
{
    meta:
        author = "valtersit.com"
        description = "Detects Langflow MCP/public-flow handling code and version markers associated with CVE-2026-85025"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85025"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $mcp1 = "mcp" ascii nocase
        $mcp2 = "/mcp/" ascii nocase
        $public = "public_flow" ascii nocase
        $shared = "shared" ascii nocase
        $ver = "1.11." ascii
        $lang1 = "langflow" ascii nocase
    condition:
        filesize < 5MB and
        $lang1 and
        ( $mcp1 or $mcp2 ) and
        ( $public or $shared ) and
        $ver
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85025 Langflow Unauthenticated MCP Public Endpoint Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/mcp"; nocase; http.uri; content:"/public"; nocase; classtype:attempted-admin; reference:cve,2026-85025; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85025; sid:8502501; rev:1; metadata:created_at 2026_01_01, affected_product Langflow, confidence Low;)

alert http any any -> any any (msg:"CVE-2026-85025 Langflow MCP Flow Execution Attempt UNauthenticated"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/mcp"; nocase; http.header; content:"Authorization"; negate; classtype:attempted-admin; reference:cve,2026-85025; sid:8502502; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http"
      and url.path : ("*/mcp*") and http.request.method == "GET" ]
  [ network where network.protocol == "http"
      and url.path : ("*/mcp*") and http.request.method == "POST"
      and http.response.status_code in (200, 201, 202) ]

Splunk SPL Query

index=web OR index=langflow sourcetype IN ("langflow:access","access_combined")
| eval uri=coalesce(uri_path, url, cs_uri_stem)
| eval code=coalesce(status, status_code, cs_status)
| where match(uri, "(?i)/(mcp|public|shared)")
| where code IN (200, 201, 202, 204)
| where isnull(Authorization) OR Authorization="" OR match(Authorization, "(?i)^(anonymous|none|bearer\\s*)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as paths by src_ip, host
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="langflow,web,attack,">
  <rule id="850250" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <url>/mcp</url>
    <description>Langflow MCP endpoint access (base event)</description>
  </rule>

  <rule id="850251" level="12">
    <if_sid>850250</if_sid>
    <id>^2(00|01|02)$</id>
    <description>CVE-2026-85025: Successful unauthenticated access to Langflow MCP/public endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85025,unauthorized_access,</group>
  </rule>

  <rule id="850252" level="14" frequency="5" timeframe="60">
    <if_matched_sid>850251</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-85025: Repeated unauthenticated Langflow MCP access from same source (possible exploitation)</description>
    <group>cve_2026_85025,exploitation_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) indicates a patch/fix exists, but this has not been independently confirmed, no vendor advisory was supplied, no fixed version number was provided, and no workaround was documented. Treat remediation as unverified and validate against the vendor before relying on it.

1. Immediate mitigations (hours).

   • Remove Langflow from direct internet exposure. Place it behind authentication (VPN, SSO reverse proxy, mTLS) — the vulnerable path requires only network reachability.
   • Disable or remove publicly shared flows/MCP projects until a verified patch is applied. If public sharing cannot be disabled, firewall the relevant endpoints to trusted networks only.
   • Restrict the Langflow service account: drop filesystem write where possible, remove unnecessary cloud/LLM credentials from the process environment, and segment the host so RCE does not grant lateral movement.
   • Rotate any LLM provider keys, database credentials, or secrets accessible to the Langflow process, on the assumption they may have been exposed.
   • Review chat-session stores for unauthorized access or tampering.

2. Patch / upgrade.

   • Monitor https://nvd.nist.gov/vuln/detail/CVE-2026-85025 and the Langflow project release channel for the official fixed version.
   • Because the fixed version is not specified in the available data, do not assume "latest" is sufficient — confirm with the vendor that the release addresses CVE-2026-85025, then upgrade and re-test the public MCP endpoint in a staging environment for authorization enforcement.
   • After upgrade, verify: (a) unauthenticated requests to MCP/public endpoints are rejected or confined to read-limited scope, and (b) one session cannot read another's chat history.

3. Long-term hardening.

   • Adopt least privilege for all Langflow deployments; never run with ambient cloud or provider credentials beyond those required.
   • Implement centralized authorization testing (CI) for public-share endpoints, treating every anonymous surface as a security boundary that requires negative tests.
   • Enforce tenant/session isolation as a platform invariant, not a per-route check, so new endpoints inherit it by default.
   • Add SAST/DAST to catch CWE-863 patterns where UI-enforced authorization is not mirrored in API handlers.
   • Keep WAF/log-based detection (rules above) in place to catch attempts before patching completes.

References

1. NVD — CVE-2026-85025: https://nvd.nist.gov/vuln/detail/CVE-2026-85025
2. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
3. MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
4. Langflow project (IBM) release/advisory channel — monitor for the fixed version addressing CVE-2026-85025.
5. EPSS Score for CVE-2026-85025 — https://api.first.org/data/v1/epss?cve=CVE-2026-85025

Threat actor / exploitation status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing at time of writing. No known threat-actor campaign is associated with this CVE in the provided data. The 36.4th-percentile EPSS value reflects a currently low observed exploitation probability, but the unauthenticated, network-reachable RCE profile means detection and exposure-reduction should not wait for weaponization.