| Severity | CRITICAL |
| Threat Category | Vulnerability – OS Command Injection / Remote Code Execution (CWE-78) |
| Affected Platforms | Langflow (langflow-ai) self-hosted AI workflow builder, all versions before 1.9.0 |
| CVE | CVE-2026-105740 |
| CVSS | 9.9 CRITICAL |
1. Overview
A critical remote code execution vulnerability has been disclosed in Langflow, the popular open-source tool for building large-language-model agents and workflows. Tracked as CVE-2026-105740, the flaw allows any authenticated Langflow user to run arbitrary operating-system commands on the server that hosts the application. The maintainers rate it 9.9 on the CVSS scale.
The vulnerability lies in how Langflow handles a Model Context Protocol (MCP) server configured with the “Stdio” transport: a command supplied by the user is executed by the host shell with no validation, allowlisting, or sandboxing. Langflow fixed the issue in version 1.9.0, and the project’s security advisory and CVE record were published on 5 October 2026. All versions before 1.9.0 are affected.
2. Who is Affected
Any organization or individual running a self-hosted Langflow instance older than version 1.9.0 is affected. Langflow is widely used by developers and data teams to prototype and host AI agents, and such instances increasingly appear inside government, academic, and private-sector environments in Bhutan as interest in AI tooling grows. Exploitation requires a valid Langflow account, but any authenticated user, regardless of their intended privilege level, can obtain full code execution.
BtCIRT has not received any reports of confirmed exploitation within Bhutan at the time of publication. The severity is nonetheless assessed as CRITICAL for the following reasons:
- Remote Code Execution (RCE): The vulnerability allows full arbitrary code execution on the underlying host with the privileges of the Langflow service account. This grants full access to sensitive stored assets, including connected data stores, API keys, and model/database credentials.
- Changed Scope (CVSS:S:C): The impact extends beyond the application’s logical security boundary to the underlying operating system. Consequently, a low-privileged application user can compromise the entire underlying host environment.
- Low Attack Complexity & Low Privileges (CVSS:PR:L/AC:L): Exploitation requires only a standard, low-privilege authenticated account. On instances with self-registration enabled, shared team access, or public exposure, the barrier to exploitation is minimal.
- High Probability of Exploitation: With public availability of technical details, a patch diff, and the official advisory, unpatched internet-facing instances face an immediate and high risk of automated exploitation.
3. How the Vulnerability Works
- Stage 1 – Root Cause
Langflow lets users connect outside tools (called MCP servers). One feature, called “Stdio,” asks users to type a terminal command so Langflow can run a helper program on the host computer. However, Langflow takes whatever command or setting the user types and runs it on the server without any validation, if it is safe, blocked, or restricted. This allows attackers to run harmful commands on the system (CWE-78, OS Command Injection).
- Stage 2 – Exploitation
An authenticated user adds an MCP server that uses the Stdio transport and places their own command in the configuration. The command is then executed on the server by the account running Langflow. Execution is triggered automatically when the application fetches its list of MCP servers, so the attacker does not need any special administrative function, only the ability to save a server entry. The separate environment-variable field can be used to further influence how processes on the host load and run.
- Stage 3 – Impact
Successful exploitation yields arbitrary command execution on the Langflow host with the privileges of the service. From there an attacker can read and alter data processed by Langflow, steal stored API keys and model or database credentials, pivot to other systems reachable from the host, install persistence, or disrupt the service. Because the malicious server entry persists and runs when the server list is fetched, it can affect the instance on an ongoing basis.
- Stage 4 – Fix and Disclosure
The flaw is addressed in version 1.9.0 by constraining how MCP Stdio commands are handled. The issue was reported by the researcher credited in the project’s advisory, published as GHSA-7w94-79vh-5mr2, and assigned CVE-2026-105740 by GitHub on October 5 2026.
4. Indicators to Watch For
- The running Langflow version is earlier than 1.9.0. Confirm the deployed version against the fixed release 1.9.0.
- MCP server entries configured with the “Stdio” transport whose command field contains anything other than a known, expected helper program.
- Unexpected child processes spawned by the Langflow service, or shell processes launched by the account that runs Langflow around the time the MCP server list is loaded.
- Outbound network connections, new files, scheduled tasks, or user accounts on the Langflow host that cannot be attributed to legitimate administration.
- Newly created or unfamiliar Langflow user accounts, particularly on instances that permit self-registration or are reachable from the internet.
5. Recommendations
5.1. For organizations and government offices:
- Upgrade every Langflow instance to version 1.9.0 or later without delay. This is the authoritative fix for the vulnerability.
- Do not expose Langflow directly to the internet. Place it behind a VPN or authenticated reverse proxy, and restrict access to a trusted management network.
- Audit all Langflow user accounts: remove unknown or unused accounts, disable open self-registration, and enforce strong, unique credentials with multi-factor authentication where supported. Treat the ability to log in as equivalent to the ability to run code on the host until patched.
- Review existing MCP server configurations for unexpected Stdio commands, and inspect the host for the indicators in Section 4. If any are found, treat the host as compromised: isolate it, rotate all credentials, API keys, and tokens it holds, and rebuild from a known-good state.
- Run Langflow with the least privilege necessary and in an isolated container or host, so that code execution within the service cannot readily reach other production systems or secrets.
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt
7. Sources and References
- GitHub Security Advisory GHSA-7w94-79vh-5mr2 – Authenticated RCE via MCP Stdio transport in Langflow (5 October 2026).
https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2 - CVE-2026-105740 – CVE Record (GitHub CNA) (5 October 2026).
https://www.cve.org/CVERecord?id=CVE-2026-105740 - Langflow pull request #12290 – fix for MCP Stdio command handling (October 2026). https://github.com/langflow-ai/langflow/pull/12290
- NVD – CVE-2026-105740 Detail (8 October 2026).
https://nvd.nist.gov/vuln/detail/CVE-2026-105740