{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-105740",
    "name": "CVE-2026-105740",
    "vendor": "langflow",
    "description": "Previdian reported on 15 October 2026 that CVE-2026-105740 (GHSA-7w94-79vh-5mr2, CVSS 9.9) is being exploited. It is the Langflow flaw in which any authenticated user could add an MCP server with the stdio transport and have its command field run through bash -c. Previdian rates the exploitation confirmed from its own sensors, first observed on 19 September 2026 and still observed on 19 October, and notes that the CVE is not in CISA KEV; its exploitation-signals table listed about 2,000 attempts by 19 October. According to reporting on Previdian's findings, the attackers checked the Langflow version, tried /api/v1/auto_login and signed in with common credentials before registering the MCP server, then read environment variables including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and sent them to an external host. Because a stored command runs whenever the server list is fetched, a planted entry also fires for other users and for admins. The flaw is fixed in 1.9.0, but a second command injection in the same transport, CVE-2026-105697 (covered in an earlier entry), needs 1.10.3.",
    "website": "https://previdian.com/CVE-2026-105740",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "langflow",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-15",
    "risk": {
      "score": 99,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-105740",
      "aliases": [
        "ti-144",
        "GHSA-7w94-79vh-5mr2"
      ],
      "title": "CVE-2026-105740: Langflow's MCP Stdio Command Injection Is Exploited in the Wild, With Payloads Reading LANGFLOW_SECRET_KEY",
      "summary": "Previdian reported on 15 October 2026 that CVE-2026-105740 (GHSA-7w94-79vh-5mr2, CVSS 9.9) is being exploited. It is the Langflow flaw in which any authenticated user could add an MCP server with the stdio transport and have its command field run through bash -c. Previdian rates the exploitation confirmed from its own sensors, first observed on 19 September 2026 and still observed on 19 October, and notes that the CVE is not in CISA KEV; its exploitation-signals table listed about 2,000 attempts by 19 October. According to reporting on Previdian's findings, the attackers checked the Langflow version, tried /api/v1/auto_login and signed in with common credentials before registering the MCP server, then read environment variables including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and sent them to an external host. Because a stored command runs whenever the server list is fetched, a planted entry also fires for other users and for admins. The flaw is fixed in 1.9.0, but a second command injection in the same transport, CVE-2026-105697 (covered in an earlier entry), needs 1.10.3.",
      "severity": "critical",
      "cvss": {
        "score": 9.9,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "langflow",
        "vendor": null,
        "package": "langflow",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<1.9.0",
          "fixed": "1.10.3"
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-10-15",
      "modifiedAt": "2026-10-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://previdian.com/CVE-2026-105740"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105740"
        },
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-7w94-79vh-5mr2"
        }
      ],
      "mitigation": "Upgrade Langflow to 1.10.3 or later, which closes both MCP stdio command injections. Until then, take internet-facing instances offline or put them behind authentication, disable auto-login (LANGFLOW_AUTO_LOGIN=false), and replace default or weak passwords. Review stored MCP server entries for ones nobody added, and logs for requests to /api/v1/auto_login and /api/v2/mcp/servers/. On any instance that was reachable while unpatched, rotate LANGFLOW_SECRET_KEY, the superuser password and every API key or credential stored in flows, and check the host for further compromise.",
      "detectedByAnomity": true
    }
  }
}