PT-2026-89598
CVE-2026-85025
·
تاريخ النشر
2026-09-10
·
تاريخ التحديث
2026-09-23
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
IBM Langflow OSS versions 1.0.0 through 1.11.5
Description
An unauthenticated attacker can execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints. This occurs because of improper enforcement of public-flow security restrictions and weak session isolation controls, which allow an attacker to pivot from public project access to server-side code execution.
Recommendations
Update IBM Langflow OSS to version 1.11.6 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾