CVE-2026-105740: Langflow Critical RCE: Authenticated Command Injection via Stdio Transport TheHackerWire / 3h Telemetry Metric Intelligence Detail CVE Identifier CVE-2026-105740 CVSS Severity 9.9 CRITICAL Affected Target 1.9.0 Vulnerability Class CWE-94: Remote Code Execution (RCE) Exploit Availability No Public PoC Indexed EPSS Threat Score Awaiting scoring CISA KEV Status Not Listed in CISA KEV Remediation Status Advisory / Mitigation In Review Any authenticated user can leverage an unvalidat

No standalone public exploit has been published in open research repositories at the time of writing. Our threat intelligence pipeline monitors GitHub, Exploit-DB, and Nuclei feeds continuously. Verified PoCs will be automatically integrated here upon discovery.

CVE-2026-105740 exposes Langflow instances to critical Remote Code Execution. Any authenticated user can leverage an unvalidated command field within the MCP server configuration to achieve immediate server compromise, enabling full system control and potential lateral movement.

Vulnerability Root Cause & Flaw Mechanism

Langflow, a platform for building and deploying AI agents, is vulnerable to Remote Code Execution (RCE) in versions prior to 1.9.0. The root cause lies in the improper handling of user-supplied input when configuring an MCP (Message Channel Protocol) server with the “Stdio” transport. Specifically, an authenticated user can add an MCP server and provide arbitrary commands within the designated `command` field. This field’s content is directly interpolated and executed by `bash -c “exec {command}”` without any form of input validation, command allowlisting, or sandboxing mechanisms. The execution of the malicious command is triggered immediately upon the system fetching the server list, indicating a direct, synchronous execution flow. Furthermore, the `env` field associated with the MCP server configuration allows for arbitrary environment variable injection, presenting an additional vector for privilege escalation or payload manipulation (e.g., `LD_PRELOAD` for shared library injection or `PATH` override for command hijacking). The specific internal function names, file paths, or exact code locations responsible for this direct execution are not detailed in the advisory and would require further reverse engineering or source code analysis.

Attack Prerequisites & Threat Vector

Successful exploitation of CVE-2026-105740 requires an authenticated session on a vulnerable Langflow instance. The attack is post-authentication, meaning an attacker must possess valid credentials to access the Langflow user interface. Network accessibility to the Langflow web interface is a prerequisite, typically over HTTP/S. There are no known requirements for specific survey hashes, API tokens, or nonces beyond standard session management. The end-to-end attack progression involves an authenticated user navigating to the MCP server configuration section within the Langflow UI. The user then initiates the creation or modification of an MCP server, selecting “Stdio” as the transport method. The malicious payload is injected into the `command` field, and optionally, environment variables are manipulated via the `env` field. The system immediately executes the injected command when the server list is subsequently fetched, leading to RCE on the underlying server running the Langflow application.

Detection, Log Analysis & Threat Hunting

Security analysts should focus on Langflow server logs for indicators of compromise. Specific telemetry to inspect includes logs related to MCP server configuration changes, particularly those involving the “Stdio” transport type. Anomalies to look for include the creation or modification of MCP servers with unusual or suspicious commands in the `command` field, or unexpected environment variable definitions in the `env` field. Process execution logs on the Langflow host should be monitored for `bash` processes spawning from the Langflow application user, especially those containing `exec` commands with non-standard arguments or child processes indicative of shell commands (e.g., `nc`, `curl`, `wget`, `python`, `php`). Network traffic originating from the Langflow server to unusual external IPs or ports, or attempts to establish reverse shells, are also strong indicators. For asset owners, a realistic Shodan or Google Recon query to identify potentially exposed Langflow instances is `http.title:”Langflow”` or `http.html:” Langflow “`.

Defensive Hardening & Mitigation

Immediate defensive hardening measures are critical for systems awaiting the vendor patch. Restrict all non-essential network access to Langflow instances, especially from the WAN, by implementing strict firewall rules or placing the application behind a Web Application Firewall (WAF). If a WAF is deployed, consider virtual patching to block requests attempting to add or modify MCP servers with “Stdio” transport and containing suspicious command-like strings. Implement network segmentation to isolate Langflow servers into a dedicated, highly restricted VLAN, limiting their ability to communicate with other internal systems. Enforce robust authentication policies and monitor for unauthorized access attempts. The confirmed vendor patch for this vulnerability is Langflow version 1.9.0. All affected deployments must be upgraded to this version or higher immediately.

Related Vulnerabilities

CVE-2026-105697: Langflow OS Command Injection Enables Unauthenticated Remote Code Execution

CVE-2026-105636: Plane Project Management Tool Critical SSRF Exposes Internal Infrastructure

CVE-2026-105691: Penpot Critical RCE: SVG Exporter `fill-color` Leads to Shell Execution

TheHackerWire Threat Intel Team