CVE-2026-105740
criticalLangflow is a tool for building and deploying AI-powered agents and workflows.
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0 security-advisories@github.com
- https://github.com/langflow-ai/langflow/pull/12290 security-advisories@github.com
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2 security-advisories@github.com
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45 security-advisories@github.com
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45 134c704f-9b21-4f2e-91b3-4a467353bcc0