Why it matters
Langflow is embedded across enterprise AI workflow deployments (including via IBM watsonx Orchestrate integration); an unauthenticated RCE in its MCP launcher gives attackers a direct path to full compromise of any exposed Langflow instance and any credentials or downstream systems it can reach, with no user interaction required.
Attack vector
The MCP (Model Context Protocol) stdio launcher's DANGEROUS_ENV_VARS blocklist fails to include security-critical environment variables, allowing an unauthenticated attacker to inject environment variables that are passed to the launched MCP subprocess, achieving arbitrary remote code execution without authentication.
Affected systems
IBM Langflow OSS 1.0.0 through 1.10.1
Mitigation
Apply IBM's patch per the IBM support advisory; restrict network exposure of Langflow MCP endpoints and audit the DANGEROUS_ENV_VARS blocklist configuration.