Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M
CVE-2026-105740Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
Critical 9.9
In plain English
A critical-severity OS command injection in langflow from langflow-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| langflow-ai | langflow | < 1.9.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2 x_refsource_CONFIRM
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45 x_refsource_MISC
- https://github.com/langflow-ai/langflow/pull/12290 x_refsource_MISC
- https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0 x_refsource_MISC