CVE-2026-105740

Langflow is a tool for building AI-powered workflows, and one of its features lets users connect it to other helper programs. This flaw means that if someone can log into Langflow — even a regular, low-level user — they can trick that connection feature into running any command they want on the server, like handing a stranger the keys to your office because they filled out a form correctly. From there, they can steal data, install malware, or shut the system down.

This matters to you if you run Langflow to build or host AI agents/workflows, on any version before 1.9.0. Any account with normal login access — not just admins — can exploit this, so it affects you even if you only give a handful of trusted employees or contractors access to Langflow.

Attackers are already exploiting this flaw in the wild, with over a thousand exploit attempts detected via honeypots since mid-October 2026, so this is an active, confirmed threat rather than a theoretical risk. Because it requires only a low-privilege login and no special user action, any Langflow instance with more than one trusted user is at real, immediate risk. Act now — do not wait for a routine maintenance window.

1. Confirm exposure: inventory all Langflow deployments and check their version; any instance below 1.9.0 with more than one authenticated user (or any user who isn't fully trusted) is exploitable, since the attack requires only authenticated, low-privilege access (PR:L), no user interaction, and is reachable over the network with Langflow's default configuration.
2. Target fix: upgrade to Langflow 1.9.0 or later, where the Stdio transport's command handling is corrected; no official patch advisory or CVSS/EPSS-independent vendor notice was found beyond the version fix, so validate the upgrade in a staging environment before production rollout.
3. Workaround if patching is delayed: disable or restrict the ability for non-admin users to add MCP servers with 'Stdio' transport; consider network-level isolation of the Langflow instance and tightening role-based access so only fully trusted accounts can log in at all.
4. Audit: review all existing MCP server configurations for unexpected commands or env variable injections (e.g., LD_PRELOAD, PATH overrides), and check server logs/honeypot-style indicators for command execution anomalies around the 'fetch server list' action.
5. Monitor: watch for unusual outbound connections, new processes spawned by the Langflow service account, and unexpected environment variable changes post-upgrade. No CISA KEV listing exists yet, but active exploitation (1,423+ detected attempts since 2026-10-15) means this should be prioritized above typical patch-cycle SLAs.

CVSS 9.9 (CRITICAL, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a command-injection weakness (CWE-78) where the MCP Stdio transport's user-supplied command field is passed directly to bash -c "exec {command}" with no validation, allowlisting, or sandboxing, and executes immediately on server-list fetch — effectively authenticated RCE with scope change (S:C) due to lack of isolation. Not yet listed in CISA KEV, but news reporting confirms active exploitation in the wild since 2026-10-15 (1,423 honeypot-detected attempts), which supersedes the EPSS prediction (flat, 47th percentile) as the operative signal. No public exploit code (PoC) has been found on record, but exploitation is clearly occurring regardless. Fixed in Langflow 1.9.0 per the vendor description; no separate PATCH advisory digest was located, so confirm the fix via release notes/changelog before relying solely on version number.