Langflow CVE-2026-105740

Requires an authenticated Langflow account (CVSS PR:L) with the ability to create/add an MCP server configuration using the 'Stdio' transport - a standard built-in feature, not a non-default or specially hardened setting, in versions prior to 1.9.0. The specific trigger is the MCP server's user-supplied 'command' field, which is passed to bash -c "exec {command}" with no allowlist, validation, or sandboxing; the 'env' field additionally permits LD_PRELOAD/PATH-style injection. Execution fires automatically when the MCP server list is fetched (no further victim interaction needed, UI:N). Limiting factors: attacker must be authenticated and must reach the MCP-server configuration function; environments that restrict account creation or MCP configuration to trusted admins substantially reduce exposure. Not exploitable on 1.9.0+, where commands are restricted to an allowlist (node/python/npx/uvx/docker/shell-wrappers) and dangerous env vars are blocked.

This is a genuine high-priority issue, not an inflated CVSS score. The 9.9 rating is driven by AV:N/AC:L/UI:N and a scope change (S:C) with full C:H/I:H/A:H impact - i.e., authenticated-but-low-privilege command execution that escapes the application boundary to the host OS. The one mitigating signal in the CVSS vector is PR:L: exploitation requires a valid authenticated Langflow account, so this is not fully anonymous/internet-wide. However, in typical Langflow deployments any authenticated user (including low-trust or self-registered users) can add an MCP server, making PR:L a weak barrier. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit flagged, so exploitation status is 'no public exploit identified at time of analysis.' The technical bar is trivial once authenticated (user-supplied command passed directly to bash -c with no validation), so absence of a published POC should not be read as low real risk - the fix commit itself documents the exact unsafe code path. SSVC framing: exploitation=none observed, automatable=no (requires an authenticated session and a UI/API action), technical impact=total. Note: the input provides a patch/fix commit as 'source code evidence,' which confirms the vulnerability and the fix but is NOT a weaponized exploit - do not conflate the two.

An attacker with any authenticated Langflow account (prior to 1.9.0) adds a new MCP server using the 'Stdio' transport and sets the command field to an arbitrary OS command (optionally injecting LD_PRELOAD or PATH via the env field). When the server list is fetched, Langflow executes bash -c "exec {command}" on the host, yielding immediate remote code execution as the Langflow process user. No public exploit code was identified in the input, but the attack is trivial to reproduce from the vulnerability description and fix diff.