CVE-2026-105740: Langflow RCE Vulnerability

CVE-2026-105740 Overview

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions prior to 1.9.0 contain a command injection vulnerability [CWE-78] in the Model Context Protocol (MCP) integration. Any authenticated Langflow user can achieve Remote Code Execution (RCE) by adding an MCP server configured with the Stdio transport. The user-supplied command field is passed directly to bash -c "exec {command}" with no validation, allowlisting, or sandboxing. The command executes as soon as the server list is fetched. The env field also permits arbitrary environment variable injection, including LD_PRELOAD and PATH overrides. The issue is fixed in Langflow 1.9.0.

Critical Impact
Authenticated attackers can run arbitrary OS commands on the Langflow host, leading to full server compromise and lateral movement into connected AI pipelines.

Affected Products

Langflow versions prior to 1.9.0
Langflow deployments exposing the MCP Stdio transport configuration to authenticated users
Self-hosted and container-based Langflow instances across all supported platforms

Discovery Timeline

2026-10-05 - CVE-2026-105740 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105740

Vulnerability Analysis

The flaw resides in the MCP stdio connection logic in src/lfx/src/lfx/base/mcp/util.py. When a user adds an MCP server using the Stdio transport, Langflow invokes the configured command through a shell wrapper. The call pattern bash -c "exec {command}" concatenates user input directly into a shell string, enabling classic command injection via metacharacters such as ;, &&, backticks, and $().

Exploitation requires only an authenticated session. The injected command runs the moment Langflow enumerates the MCP server's tool list, giving an attacker synchronous feedback and reliable execution. Successful exploitation yields code execution under the Langflow service account, which typically has access to API keys, model credentials, and connected data stores.

Root Cause

The vulnerable connector trusted user-supplied strings as safe shell input. It performed no allowlisting of binaries, no argument separation, and no sandboxing. The additional env dictionary was forwarded to the child process without filtering, allowing injection of dangerous variables such as LD_PRELOAD, BASH_ENV, and PATH to hijack execution even when the base command appeared benign.

Attack Vector

An authenticated attacker opens the MCP server configuration, selects the Stdio transport, and supplies a crafted command or env payload. Fetching the tool list triggers the shell invocation and executes the attacker-controlled payload on the server.

python

        self._component_cache = component_cache

    async def _connect_to_server(self, command_str: str, env: dict[str, str] | None = None) -> list[StructuredTool]:
-        """Connect to MCP server using stdio transport (SDK style)."""
+        """Connect to MCP server using stdio transport (SDK style).
+
+        .. todo:: Remove the ``bash -c`` / ``cmd /c`` shell wrapper and pass
+           command + args directly to ``StdioServerParameters`` (i.e.
+           ``shell=False`` semantics).  This would eliminate an entire class of
+           injection vectors (shell metacharacters, IFS manipulation,
+           BASH_ENV/BASH_FUNC_* startup injection) and allow removing several
+           entries from ``DANGEROUS_ENV_VARS`` in ``schemas.py``.  Requires:
+           1. Changing the signature to accept ``(command, args)`` separately.
+           2. Updating ``update_tools()`` to stop joining into a shell string.
+           3. Handling multi-word ``command`` config values (e.g.
+              ``"uvx mcp-server-fetch"``) by splitting at the caller.
+           4. Verifying Windows PATH resolution works without ``cmd /c``
+              (e.g. ``.cmd`` wrapper scripts like ``npx.cmd``).
+           5. Replacing the ``|| echo 'Command failed…'`` error-reporting
+              pattern with proper exit-code handling from ``anyio.open_process``.
+        """
        from mcp import StdioServerParameters

        command = shlex.split(command_str)

Source: GitHub Commit efbc4a1 — the patch adds allowlist validation and documents the follow-up work to remove the shell wrapper entirely.

Detection Methods for CVE-2026-105740

Indicators of Compromise

Unexpected bash -c or cmd /c child processes spawned by the Langflow server process.
MCP server configurations containing shell metacharacters (;, &&, |, backticks, $()) in the command field.
Child processes with suspicious environment variables such as LD_PRELOAD, BASH_ENV, or redefined PATH.
Outbound network connections from Langflow workers to unknown hosts shortly after MCP tool list refreshes.

Detection Strategies

Review Langflow audit logs for MCP server add or edit events, correlating the command and env fields against an approved allowlist.
Hunt for process trees where the Langflow Python interpreter spawns shells that in turn spawn interpreters such as python, perl, curl, wget, or nc.
Baseline normal MCP binaries (for example uvx, npx) and alert on any deviation.

Monitoring Recommendations

Forward Langflow application logs and host process telemetry to a central analytics platform for correlation.
Monitor file integrity on src/lfx/src/lfx/base/mcp/util.py and related MCP schema files.
Alert on new or modified MCP server entries in the Langflow database, especially from non-administrator accounts.

How to Mitigate CVE-2026-105740

Immediate Actions Required

Upgrade Langflow to version 1.9.0 or later without delay.
Rotate any credentials, API tokens, and model keys that were accessible to the Langflow service account.
Audit existing MCP server configurations and remove entries with unexpected command or env values.
Restrict account creation and require strong authentication to limit who can configure MCP servers.

Patch Information

The fix landed in Langflow 1.9.0 via GitHub Pull Request #12290 and commit efbc4a1. The patch introduces allowlist validation for MCP commands. See the vendor advisories GHSA-7w94-79vh-5mr2 and GHSA-w794-rj3p-xv45 for full remediation guidance.

Workarounds

Disable the MCP Stdio transport in environments that cannot upgrade immediately.
Place Langflow behind a reverse proxy that blocks access to the MCP server configuration endpoints for non-administrators.
Run Langflow inside a hardened container with a read-only filesystem, dropped capabilities, and no outbound internet access.
Apply mandatory access controls (AppArmor, SELinux) to prevent the Langflow process from spawning arbitrary shells.

bash

# Upgrade Langflow to the patched release
pip install --upgrade "langflow>=1.9.0"

# Verify the installed version
python -c "import langflow; print(langflow.__version__)"