CVE-2026-105740

Executive Summary

CVE-2026-105740 is a critical OS command injection vulnerability (CWE-78) in Langflow, a platform for building and deploying AI-powered agents and workflows. Any authenticated user can achieve Remote Code Execution by adding an MCP server using the "Stdio" transport, where the user-supplied command field is passed directly to bash -c "exec {command}" without validation, allowlisting, or sandboxing. With a CVSS score of 9.9 and a scope change (S:C), exploitation grants full compromise of the host server, including confidentiality, integrity, and availability impacts.

Technical Analysis

Langflow allows users to register external MCP (Model Context Protocol) servers as integrations. One supported transport mode is "Stdio," which spawns a local process and communicates over standard input/output. To do this, Langflow accepts a user-provided command field intended to specify the binary/arguments of the MCP server process.

The vulnerability lies in how that command value is executed. According to the NVD description, the field is passed directly into a shell invocation of the form:

bash -c "exec {command}"

There is zero validation, no allowlisting, and no sandboxing applied to the input. Because the value is interpolated into a bash -c string, shell metacharacters are honored. An authenticated attacker who can set the command field fully controls the string handed to bash, enabling arbitrary command execution under the security context of the Langflow process. The description explicitly notes that the command executes immediately when the server list is fetched, meaning exploitation does not require a separate "run" action beyond retrieving the configured server list.

Additionally, the env field permits arbitrary environment variable injection. This is an independent but related vector: values such as LD_PRELOAD (dynamic linker preload of an attacker-controlled shared object for code injection) or PATH override (hijacking resolution of subsequently invoked binaries) can be set to subvert process execution even absent direct shell injection, or to reinforce and persist command execution.

Root cause class: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection"). The underlying design flaw is the use of a shell (bash -c) to execute attacker-influenced input in place of direct, argument-vector process spawning without a shell, combined with the absence of input allowlisting and process sandboxing.

Affected component: the MCP server configuration flow with "Stdio" transport, specifically the command and env fields. Fix version: 1.9.0. No patch evidence is available from tracked sources as of this report (patch confidence 0/4); affected version ranges beyond "< 1.9.0" are not enumerated in provided data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the details in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed Langflow instance. Because any authenticated user can trigger the flaw, the barrier to entry is a valid low-privileged account (PR:L). This reduces the need for pre-authentication access and makes the vulnerability attractive for insider misuse, credential-stuffing against default/weak accounts, and post-compromise lateral movement targets.

2. Triggering the flaw. The attacker authenticates and adds or configures an MCP server using the "Stdio" transport. The attacker supplies a crafted value in the command field. Because the field is interpolated directly into bash -c "exec {command}", the attacker includes shell metacharacters and OS commands inline with (or instead of) a legitimate command path. No allowlist or sanitization step rejects the input.

3. Execution method (vulnerability-class level). The command executes immediately when the server list is fetched. The attacker performs the list-fetch action, causing bash to evaluate the injected string and run the attacker's operating-system commands on the host under the Langflow process's privileges. Independently, the attacker can set env values (for example LD_PRELOAD pointing at an attacker-supplied shared object, or a PATH override) to inject code or redirect binary resolution when the Stdio process launches. As with all command-injection issues of this class, the specific payload content is attacker-defined and not enumerated in the available data.

4. Post-exploitation impact. Given the scope change in the CVSS vector (S:C), successful exploitation enables the attacker to escape the intended user/application boundary and affect resources beyond the vulnerable component — i.e., the underlying host and any secrets or data it can reach. From a shell obtained in the Langflow process context, the attacker can read environment variables and application secrets, exfiltrate workflow/agent data, establish persistence, pivot to internal services reachable from the host, and tamper with or destroy data (C:H/I:H/A:H).

Impact Assessment

• Confidentiality (C:H): Full read access to data accessible by the Langflow process, including API keys, model provider credentials, workflow definitions, and any secrets present in environment variables or mounted files.
• Integrity (I:H): Arbitrary command execution permits modification of application data, configurations, and the host filesystem; workflow logic and outputs could be tampered with.
• Availability (A:H): The attacker can terminate processes, delete data, or degrade/kill the host, disrupting all agent and workflow operations.
• Scope (S:C): The blast radius extends beyond the Langflow component to the host and adjacent systems, elevating overall severity.
• Attack vector prerequisites: Network-reachable (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N). Aggregate CVSS 9.9 — Critical.
• Affected systems: Langflow deployments prior to 1.9.0 that expose the MCP "Stdio" server configuration to authenticated users. Environments running Langflow with broad host privileges, mounted secrets, or network reachability to internal infrastructure face the greatest exposure.
• EPSS: Not yet scored by FIRST.org (no value fabricated). CISA KEV: Not listed. Public exploit/PoC: None observed.

Detection Guidance

Sigma Rule

title: Langflow MCP Stdio Command Injection Attempt (CVE-2026-105740)
id: 7f3a9c1e-2b4d-4e88-9c0a-langflow105740
status: experimental
description: Detects creation/modification of Langflow MCP server configurations using the Stdio transport with shell metacharacters in the command field, consistent with CVE-2026-105740 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105740
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: langflow
detection:
  selection_command:
    command|contains:
      - ';'
      - '&&'
      - '||'
      - '|'
      - '$('
      - '`'
      - '>/'
      - 'exec '
  selection_field:
    - field_name: 'command'
    - field_name: 'env'
  condition: selection_field and selection_command
falsepositives:
  - Legitimate MCP stdio commands that include pipes or arguments
level: high
tags:
  - attack.t1190
  - cve.2026.105740

YARA Rule

rule CVE_2026_105740_Langflow_MCP_CommandInjection
{
    meta:
        description = "Detects Langflow MCP Stdio command injection payloads (CVE-2026-105740)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105740"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $mcp      = "mcp" nocase
        $stdio    = "Stdio" nocase
        $command  = "command" nocase
        $env      = "env" nocase
        $ld       = "LD_PRELOAD" nocase
        $bash     = "bash" nocase
        $exec     = "exec " nocase
        $inj1     = "$("
        $inj2     = "&&"
        $inj3     = "||"
        $inj4     = ";"
        $inj5     = "`"
    condition:
        uint16(0) == 0x7b7b or uint16(0) == 0x0a7b or
        (any of ($mcp, $stdio) and any of ($command, $env) and any of ($inj1, $inj2, $inj3, $inj4, $inj5, $ld, $bash, $exec))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105740 Langflow MCP Stdio Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"mcp"; nocase; http.request_body; content:"Stdio"; nocase; http.request_body; content:"command"; nocase; pcre:"/(\$\(|`|;|\|\||&&)/"; reference:cve,2026-105740; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105740; classtype:web-application-attack; sid:2026105740; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.parent.name == "langflow"]
  [process where process.name == "bash" and process.args : ("-c" and "exec") and
     process.args : ("*;*", "*&&*", "*||*", "*`*", "*$(*")]

Splunk SPL Query

index=langflow OR index=app_logs sourcetype=langflow*
| search ("mcp" OR "stdio" OR "Stdio") ("command" OR "env")
| rex field=_raw "(?i)(command|env)\s*[:=]\s*\"?(?<cmdval>[^\"]+)"
| where match(cmdval, "(;|&&|\|\||\||\$\(|`|LD_PRELOAD|PATH=)")
| table _time host user src_ip cmdval
| sort - _time

Wazuh OSSEC Rule

<group name="langflow,cve-2026-105740,">
  <rule id="105740" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">mcp_server_create</field>
    <field name="command">\.|;</field>
    <description>CVE-2026-105740: Langflow MCP Stdio command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,</group>
  </rule>
  <rule id="105741" level="12">
    <decoded_as>json</decoded_as>
    <field name="field_name">env</field>
    <field name="field_value">LD_PRELOAD|PATH</field>
    <description>CVE-2026-105740: Langflow env variable injection (LD_PRELOAD/PATH) detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is enumerated in the provided data; the NVD description states the vulnerability is "fixed in 1.9.0."

1. Immediate mitigations.

   • Restrict access to Langflow to trusted networks; do not expose MCP server configuration to broad authenticated user populations.
   • Enforce least privilege on the Langflow service account: run it as an unprivileged, dedicated user with a minimal filesystem/network footprint, and avoid mounting secrets it does not strictly require.
   • Disable or block the "Stdio" MCP transport for untrusted users if the deployment allows policy control over MCP transports.
   • Monitor for configuration changes to MCP servers and for shell invocation (bash -c "exec ...") originating from the Langflow process.
   • Apply network egress filtering to limit post-exploitation lateral movement.

2. Patch/upgrade steps.

   • Upgrade Langflow to 1.9.0 or later, which the NVD description identifies as the fixed release.
   • Because patch confidence is 0/4, independently verify the fix in the target release notes/changelog before relying on it; the tracked sources contain no confirmed patch artifact.
   • After upgrade, audit existing MCP server configurations for unauthorized or malicious command/env entries and review host process history for pre-upgrade exploitation.

3. Long-term hardening.

   • Replace shell-based invocation (bash -c) with direct argument-vector process spawning (no shell), and apply strict allowlisting of permitted commands.
   • Sandbox MCP stdio process execution (containers, seccomp/AppArmor, cgroups) and strip or allowlist environment variables to prevent LD_PRELOAD/PATH abuse.
   • Separate MCP server administration behind an elevated role; do not allow any authenticated user to define executable commands.
   • Implement audit logging on all MCP configuration changes and alert on shell metacharacters in configurable fields.
   • Adopt a vulnerability-management process with SBOM coverage so unpatched CVEs in AI orchestration tooling are tracked to closure.

References

• NVD — CVE-2026-105740: https://nvd.nist.gov/vuln/detail/CVE-2026-105740
• CWE-78: Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• Langflow upstream project (release/changelog for 1.9.0): https://github.com/langflow-ai/langflow/releases
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No public PoC, exploit code, or threat-actor campaign has been identified in the provided data; EPSS is not yet scored by FIRST.org.