CVE-2026-85025

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5

Description An unauthenticated attacker can execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints. This occurs because of improper enforcement of public-flow security restrictions and weak session isolation controls, which allow an attacker to pivot from public project access to server-side code execution.

Recommendations Update IBM Langflow OSS to version 1.11.6 or later.