CVE-2026-105740 in Langflow
Summary
by MITRE • 10/06/2026
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
Langflow serves as a platform for constructing and deploying artificial intelligence agents and automated workflows, facilitating complex interactions between large language models and external tools. However, versions prior to 1.9.0 contain a critical security flaw that allows authenticated users to execute arbitrary commands on the underlying server infrastructure. This vulnerability stems from an improper restriction of functional availability within the system's configuration interface, specifically when interacting with Model Context Protocol servers using the Standard Input/Output transport mechanism. The core technical deficiency lies in how user-supplied input is processed during the initialization and retrieval phases of these external tool integrations.
The specific technical flaw involves the direct injection of unvalidated command strings into a shell execution context. When an authenticated user configures an MCP server with Stdio transport, they can provide a custom command field that is passed directly to the system via bash -c "exec {command}". This implementation lacks any form of input validation, allowlisting of permitted commands, or sandboxing mechanisms to restrict the scope of execution. Consequently, there are no safeguards preventing the user from specifying shell metacharacters, pipes, or other scripting elements that alter the intended behavior of the command interpreter. The vulnerability is particularly severe because it does not require complex exploitation chains; the malicious payload executes immediately upon fetching the server list, which may occur automatically during routine application usage or dashboard loading.
Beyond direct code execution through the command field, the vulnerability extends to environment variable manipulation. Users can inject arbitrary values into critical environment variables such as LD_PRELOAD or PATH overrides within the context of the executed process. This capability allows for further exploitation techniques, including library injection attacks that could lead to privilege escalation or bypassing of security controls already present in the application layer. The combination of unrestricted command execution and environment variable manipulation creates a comprehensive attack vector that compromises the integrity and confidentiality of the host system running Langflow.
The operational impact of this vulnerability is severe, as it effectively grants any authenticated user full remote code execution capabilities on the server hosting the Langflow instance. An attacker with valid credentials can exfiltrate sensitive data, install malware, pivot to other systems within the network, or disrupt service availability by consuming system resources. Since authentication is required, the attack surface is limited to users who have already gained access to the application, but this does not mitigate the severity of the resulting compromise. The lack of sandboxing means that the executed commands run with the same privileges as the Langflow process itself, which often runs with elevated permissions in production environments for ease of deployment and file system access.
To address this issue, organizations must upgrade to version 1.9.0 or later, where the developers have implemented fixes to sanitize input and restrict dangerous execution paths. In addition to applying the software patch, administrators should enforce strict least-privilege principles by ensuring that Langflow runs under a dedicated user account with minimal system permissions. Network segmentation can also help contain potential damage if an attacker gains initial access. Monitoring for unusual process creation or network connections originating from the application server is recommended as part of a defense-in-depth strategy. This vulnerability aligns with CWE-78, which describes improper neutralization of special elements used in an OS command, commonly known as OS Command Injection. From a tactical perspective, this exploitation technique corresponds to ATT&CK T1059, specifically the use of shell commands for execution and potentially T1620 for reflection-based evasion if attackers attempt to mask their activities within legitimate process trees.