CVE-2026-105740
Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
- CVSS 3.1
- 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 1.05% probability · 64th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Source
- security-advisories@github.com
EPSS moved from 0.6% on 6 October 2026 to 1.0% on 26 October 2026.
References
- https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0
- https://github.com/langflow-ai/langflow/pull/12290
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.