CoreCVE
Back

CRITICAL

Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Published Oct 5, 2026

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

Change history (1)
  1. EUVD

    • Updated

      changed from Oct 5, 2026 to Oct 6, 2026

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Oct 5, 2026
Updated Oct 6, 2026
Reserved Oct 5, 2026
Link CVE-2026-105740
CISA Vulnrichment
Updated Oct 6, 2026
NVD
Status Undergoing Analysis
Modified Oct 6, 2026
Link CVE-2026-105740
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-105740
ENISA EUVD
Assigner GitHub_M
Published Oct 5, 2026
Updated Oct 6, 2026
Exploited since n/a
Link EUVD-2026-92799
EUVD-2026-92799