Langflow: Authenticated remote code execution via MCP Stdio transport
Summary
Langflow, a platform for building AI agents and workflows, lets any authenticated user add an MCP server with the Stdio transport. The command and env fields are passed to bash without validation, so the command runs on the server as soon as the server list is fetched. An attacker can execute arbitrary OS commands as the Langflow process user, which may expose model-provider keys, database URLs and the secret key. If auto-login is enabled, no credentials are needed, which raises the risk considerably.
Affected
- Langflow versions before 1.9.0 (CVE record and GHSA-7w94-79vh-5mr2)
- Langflow 1.9.x: the 1.9.0 fix is incomplete according to GHSA-w794-rj3p-xv45 and a public test result
Fixed in
- Langflow 1.10.3 or later (complete fix per GHSA-w794-rj3p-xv45 and OSV PYSEC-2026-4237)
- Langflow 1.9.0 is listed as the fix in the CVE record but does not fully close the issue
Workaround
- Set LANGFLOW_AUTO_LOGIN=false
- Keep Langflow away from untrusted networks
- Restrict MCP Stdio use to essential administrators
- Run Langflow as non-root and do not mount the Docker socket into the container
Exploitation
- Exploitation attempts are reported in the wild: 1,423 to 2,023 honeypot attempts according to various sources, not confirmed compromises
- Previdian reports first activity on 19 Sep 2026
- CISA SSVC: exploitation status poc, automatable no, technical impact total
- Not listed in CISA KEV in the sources reviewed (not verified against the catalogue)
- Public PoC details exist in the GHSA advisory and a Nuclei detection template is available
Our recommendation
- Upgrade to Langflow 1.10.3 or later; 1.9.0 is not sufficient
- Disable auto-login and limit access to Langflow to trusted users
- Review stored MCP server entries for unexpected commands or env values
- If exposure is suspected, rotate LANGFLOW_SECRET_KEY, API keys and stored credentials
- Check logs for Langflow spawning bash child processes and review requests to MCP endpoints
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-7w94-79vh-5mr2 security advisory github.com
- GHSA-w794-rj3p-xv45 security advisory github.com
- Fix commit efbc4a1 github.com
- Pull request #12290 github.com
- OSV PYSEC-2026-4237 osv.dev
- Nuclei templates pull request #17435 github.com
- Previdian CVE-2026-105740 previdian.com
- Honeypot exploitation report (ai-redteam) www.ai-redteam.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:42.
Original description (NVD)
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
NVD references (6)
- https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0
- https://github.com/langflow-ai/langflow/pull/12290
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.