CVE-2026-105740

9.9 CRITICALpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI risk analysis

Summary: This vulnerability allows any authenticated user to execute arbitrary code on the server by adding an MCP server with the 'Stdio' transport, due to lack of validation and sandboxing.
Exploitability: Exploitation is relatively easy as it requires an authenticated user with the ability to add an MCP server. The 'Stdio' transport is a precondition for the vulnerability to be triggered.
Blast radius: If exploited, this could lead to complete server compromise, allowing the attacker to execute arbitrary commands and potentially gain full control over the system.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Langflow 1.9.0 or later.

rceauth-bypassserverbash

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-78

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.