01 / EXECUTIVE SUMMARY
The NVD record for CVE-2026-12940 carries an IBM PSIRT CVSS 3.1 base score of 9.8. IBM Langflow OSS 1.0.0 through 1.10.1 is described as vulnerable to unauthenticated remote code execution through environment-variable injection in the MCP stdio launcher.
02 / WHAT HAPPENED
The NVD record for CVE-2026-12940 carries an IBM PSIRT CVSS 3.1 base score of 9.8. IBM Langflow OSS 1.0.0 through 1.10.1 is described as vulnerable to unauthenticated remote code execution through environment-variable injection in the MCP stdio launcher.
The chain distinguishes what appeared valid, what was physically true, which authority followed and what consequence the source documents.
An MCP stdio launch request entered an AI workflow as an executable tool interaction.
Unblocked shell environment variables could alter execution and grant remote code authority without authentication.
NVD published the CNA-submitted record with affected versions and IBM PSIRT scoring; the record remained awaiting NVD analysis at the 4SI verification time.
The NVD record establishes technical exposure, not a realized incident or loss total.
An authenticated principal, constrained environment and explicit execution permit at every MCP tool launch.
ECR separates a documented monetary floor from a modeled social and economic consequence envelope. It is not an accounting loss figure.
The public record establishes the control failure or authority action, not a realized loss total. The range is a deliberately wide scenario envelope.
Description, affected versions and CVSS data are attributable to IBM PSIRT and displayed by NVD. NVD had not completed an independent analysis at the 4SI verification time. 4SI supplies the Presence interpretation and event score.
A tool protocol can become an authority channel when a launch request is allowed to modify the execution environment without a verified principal.
4SI does not claim to have independently verified the underlying event. Scores, boundary analysis and economic ranges interpret published evidence; they are not probabilities, compliance findings, valuations or loss forecasts.
Related cases are editorially connected by domain, authority pattern or missing physical trust boundary.