CVE-2026-12940
published 2026-07-30CVE-2026-12940: IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.94%
59.7th percentile
IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | langflow_oss | 1.0.0 – 1.10.1 | — |
| langflow | langflow | >= 1.0.0 < 1.10.2 | 1.10.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Langflow up to 1.10.1 MCP stdio launcher util.py injection (EUVD-2026-51240)
vuldb·2026-07-30·CVSS 9.8
CVE-2026-12940 [CRITICAL] IBM Langflow up to 1.10.1 MCP stdio launcher util.py injection (EUVD-2026-51240)
A vulnerability described as critical has been identified in IBM Langflow up to 1.10.1. Affected by this issue is some unknown functionality of the file src/lfx/src/lfx/base/mcp/util.py of the component MCP stdio launcher. The manipulation results in injection.
This vulnerability was named CVE-2026-12940. The attack may be performed from remote. There is no available exploit.
GHSA
IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher.
ghsa_unreviewed·2026-07-30
CVE-2026-12940 [CRITICAL] CWE-78 IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher.
IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-30
Published