EUVD Vulnerability Catalog

EUVD-2026-75748

Severity: CRITICAL Base Score: 9.8 CVSS Version: 3.1

Vulnerability Description

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Scope (S): Unchanged

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): High

▪ Availability Impact (A): High

Affected Vendors & Systems

Vendor IBM

References & Advisory Links

https://www.ibm.com/support/pages/node/7286666

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

ibm

EPSS Probability

Known Aliases

CVE-2026-85025 GHSA-j9vg-5378-pr5p

Published On

2026-09-10

Last Updated

2026-09-11