{"cve":{"cve_id":"CVE-2026-105740","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00589,"epss_percentile":0.46981,"epss_as_of":"2026-10-15","description":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the \"Stdio\" transport. The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.","published_at":"2026-10-05T20:46:18.854000Z","last_modified_at":"2026-10-06T19:17:41.197000Z","cvss_v3_score":9.9,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_v3_severity":"CRITICAL","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":["CWE-78"],"nvd_references":["https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","https://github.com/langflow-ai/langflow/pull/12290","https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0"],"vuln_status":"Undergoing Analysis","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-10-05T22:34:34.423313Z","updated_at":"2026-10-06T21:36:59.240731Z"},"effective_severity":"CRITICAL","badges":["news"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"L","value_label":"Low"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"C","value_label":"Changed"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"H","value_label":"High"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"langflow-ai","vendor_name":"langflow-ai","product_slug":"langflow","product_name":"langflow","version_start":"< 1.9.0","version_start_inclusive":true,"version_end":"< 1.9.0","version_end_inclusive":true,"cpe23_uri":"cve5:langflow-ai:langflow:< 1.9.0:< 1.9.0"}],"exploit_refs":[],"news":[{"id":2584,"source":"The Hacker News","url":"https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html","title":"Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts","summary":"Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.\n\nLangflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.\n\nThe vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1tlAL_zc7Hg-gD5PRFa08hoOp2KRDu9kNSJk8nhZ91us8q-K7qGfnoasa6gONBjZoEtGJqPEZY3rKMy4Uqozk89X-L7IQBV8IrDqnJYdtAsCC4d08mmQUI4r_zACmvDVdey82w7FC4lTIoYfqdwYYu2Bp_Ql0AwOB54KRYrHk9ixjo27rKLWEK0dwsfw3/s1600/langflow.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-10-15T07:07:05Z","fetched_at":"2026-10-15T09:30:21.475879Z","trending_score":0.02372940360478346,"cve_ids":["CVE-2026-105740"]}],"references":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://github.com/langflow-ai/langflow/pull/12290","source_type":"PATCH","tags":["patch"]},{"url":"https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0","source_type":"PATCH","tags":["patch"]}],"timeline":[{"type":"published","at":"2026-10-05T20:46:18.854000Z","label":"CVE published","source":null},{"type":"first_article","at":"2026-10-15T07:07:05Z","label":"First news coverage","source":"The Hacker News"}]}