IBM’s Langflow advisory identifies an attack path associated with MCP tool enumeration in Langflow 1.0 through 1.12.8. Tool listing normally appears read-only, but the vendor reports that it could reach an executable sink under specific conditions. That contrast is the relevant security failure: a metadata operation potentially causes host process execution…
Inspect the ClaimsCase · DiggingBeagle record
Langflow MCP tool enumeration exposed a remote code-execution path
Langflow versions before 1.13.0 were affected by CVE-2026-110186, an MCP tool enumeration issue described as potentially unauthenticated code execution.
Scope
Langflow 1.0 to 1.12.8 on the affected MCP tool-listing route. Exact default exposure and reproducible unauthenticated request details are not supplied in the vendor summary.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
IBM reports CVE-2026-110186 and repaired versions; a full public exploit chain and verified wild-campaign count are absent. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-LANGFLOW-TOOL-LISTING-1 · IBM Langflow OSS multi-vulnerability bulletin for 1.13.0
At a glance
An allegedly read-only listing endpoint and a process-execution sink are distinct layers; exact reproduction remains necessary.
Read the implicationsThe vulnerable call stack and attacker-controlled fields were not published in detail. No active exploitation count is established.
Limits and uncertaintyFull account
IBM’s Langflow advisory identifies an attack path associated with MCP tool enumeration in Langflow 1.0 through 1.12.8. Tool listing normally appears read-only, but the vendor reports that it could reach an executable sink under specific conditions. That contrast is the relevant security failure: a metadata operation potentially causes host process execution before normal user authorization can be enforced. The bulletin labels the CVE critical, though it does not publish a complete exploit request trace.
The reported fix is 1.13.0. This issue is not automatically the same as the older Langflow MCP stdio command-execution flaw, which involved another route and advisory. They share a product and broad consequence but must retain distinct CVE identities and evidence unless code-level reconciliation proves equivalence.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-LANGFLOW-TOOL-LISTING-1IBM reports CVE-2026-110186 as a critical Langflow MCP tool-enumeration code-execution vulnerability fixed by Langflow 1.13.0.supported
Basis: reported finding
- supportsIBM Langflow OSS multi-vulnerability bulletin for 1.13.0vendor statement
IBM bulletin, CVE-2026-110186 description and fixed release
Implications
An allegedly read-only listing endpoint and a process-execution sink are distinct layers; exact reproduction remains necessary.
Controls and mitigations
- Upgrade to 1.13.0 or later, require authentication before MCP listing and exercise listing paths with a no-execution runtime test.
Unknowns and contradictions
- The vulnerable call stack and attacker-controlled fields were not published in detail.
- No active exploitation count is established.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208