Skip to content
Critical RCE Vulnerability in Langflow Exposed

Critical RCE Vulnerability in Langflow Exposed

First seen 6 Oct 2026, 02:26 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 6, 2026 at 02:26 UTC
  • •CVE-2026-105740 allows RCE via unvalidated command execution.
  • •Affected versions of Langflow are prior to 1.9.0; update is critical.
  • •Exploitation requires low privileges and can be done over the network.

CVE-2026-105740 is a critical remote code execution (RCE) vulnerability affecting Langflow versions prior to 1.9.0. Authenticated users can exploit this flaw by adding an MCP server with the 'Stdio' transport, allowing arbitrary OS commands to be executed without validation. The vulnerability was published on October 5, 2026, with a CVSS score of 9.9, indicating severe risk. Exploitation can occur over the network with low privileges required, and no user interaction is necessary. The flaw allows for immediate execution of malicious commands when the server list is fetched. The vulnerability has been fixed in version 1.9.0, and users are urged to update immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-05
CVE-2026-105740 published
Langflow disclosed a critical RCE vulnerability affecting versions before 1.9.0.
Feedly
2026-10-06
Vulnerability details reported
Multiple outlets reported on the critical nature of CVE-2026-105740 and its implications.
The Hacker Wire

More articles in this cluster (6)

Following this threat?

Track CVE-2026-105740 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4

Common questions

Which versions of Langflow are affected?
All versions prior to 1.9.0 are affected by CVE-2026-105740.
What is the CVSS score for this vulnerability?
CVE-2026-105740 has a CVSS score of 9.9, indicating a critical severity level.
What should users do to protect themselves?
Users should update Langflow to version 1.9.0 or later to mitigate the vulnerability.