{"id":"CVE-2026-105740","published":"2026-10-05T21:16:35.567","lastModified":"2026-10-06T19:17:41.197","description":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the \"Stdio\" transport. The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0","tags":[]},{"url":"https://github.com/langflow-ai/langflow/pull/12290","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","tags":[]}],"exploitRefs":[{"url":"https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0","tags":[]},{"url":"https://github.com/langflow-ai/langflow/pull/12290","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","tags":[]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows any authenticated user to execute arbitrary code on the server by adding an MCP server with the 'Stdio' transport, due to lack of validation and sandboxing.","exploitability":"Exploitation is relatively easy as it requires an authenticated user with the ability to add an MCP server. The 'Stdio' transport is a precondition for the vulnerability to be triggered.","blast_radius":"If exploited, this could lead to complete server compromise, allowing the attacker to execute arbitrary commands and potentially gain full control over the system.","remediation":"Upgrade to Langflow 1.9.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","server","bash"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:44:22.171Z"}}