CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
Authenticated users can execute arbitrary OS commands on the server by injecting malicious commands into the MCP Stdio transport configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105740?
CVE-2026-105740 is a critical command injection vulnerability in langflow-ai langflow, published on 5 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-105740?
How do I fix CVE-2026-105740?
No fix has been published for CVE-2026-105740 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-105740 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105740 exists.