Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105740— Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Quick assessment

Affected
langflow-ai langflow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Langflow 是一款用于构建和部署 AI 驱动代理和工作流的工具。在 1.9.0 版本之前，任何经过身份验证的 Langflow 用户都可以通过添加使用“Stdio”传输方式的 MCP 服务器，在服务器上实现远程代码执行（RCE）。用户提供的命令字段会直接传递给 ，没有任何验证、白名单限制或沙箱保护。当获取服务器列表时，该命令会立即执行。此外， 字段允许任意环境变量注入（例如 LD_PRELOAD、PATH 覆盖等）。该漏洞已在 1.9.0 版本中修复。

CVSS 9.9 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105740

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
Source: CVE Program / CVE List V5
Vulnerability Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
langflow-ai langflow < 1.9.0 -

II. Public POCs for CVE-2026-105740

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105740

请登录查看更多情报信息。

Other References for CVE-2026-105740 (4)

Same Patch Batch · langflow-ai · 2026-10-05 · 5 CVEs total

CVE-2026-105697 9.9 CRITICAL Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurati
CVE-2026-105699 7.1 HIGH Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
CVE-2026-105741 7.1 HIGH Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
CVE-2026-105698 5.4 MEDIUM Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_i

IV. Related Vulnerabilities

Same product: langflow
Same vendor: langflow-ai
Same weakness: CWE-78

V. Comments for CVE-2026-105740

No comments yet

Leave a comment