Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-85025
By Ron Shemesh |
12 September 2026
CVE-2026-85025 – Langflow OSS public MCP endpoints allow unauthenticated RCE and session access
IBM Langflow OSS 1.0.0 through 1.11.5 improperly enforces public-flow security restrictions and session isolation on publicly shared MCP project endpoints, allowing unauthenticated network attackers to execute arbitrary code and access/modify chat sessions. Upgrade to 1.11.6 to remediate.