Loading vulnerability…
CVE-2026-105740 is an authenticated OS command-injection vulnerability in Langflow versions earlier than 1.9.0. Any authenticated user, including a non-administrator, can add an MCP server using the Stdio transport and supply an arbitrary command. Langflow passes the command field directly to bash -c "exec {command}" without validation, executable allowlisting, or sandboxing. Fetching the MCP server list triggers execution with the Langflow process's privileges. The configuration's env field also permits arbitrary environment-variable injection, including dynamic-loader manipulation and executable-search-path overrides. Stored malicious MCP configurations can execute again whenever the server list is loaded. Langflow 1.9.0 fixes the vulnerability.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authenticated remote code execution vulnerability involving Langflow's MCP functionality. The content describes an intrusive detection template using a Python callback command and marks the template as verified through real-product validation. It does not establish exploitation in the wild or patch availability.
A critical authenticated remote code execution vulnerability in Langflow's stdio MCP-server configuration. Any authenticated user, including nonadministrators, can supply an unrestricted command that executes with the Langflow process's privileges when the server list is requested. Arbitrary environment variables can also be injected. Persisted malicious configurations can cause repeated execution, potentially enabling server compromise, credential theft, lateral movement, and persistence.
A critical authenticated remote code execution vulnerability in Langflow versions before 1.9.0. Any authenticated user, including non-admin users, can submit an MCP stdio server configuration containing an unvalidated command that executes with the Langflow process's privileges when the server list is fetched. Arbitrary environment variable injection is also possible. The stored configuration enables repeated execution and potential persistent compromise. Previdian recorded 1,423 exploitation attempts from 27 unique attacker IP addresses beginning September 19, 2026.
Critical OS command injection in Langflow's MCP server configuration, rated CVSS v3.1 9.9. An authenticated attacker can craft the command field passed directly to Bash through MCP's stdio transport, executing arbitrary commands without sandbox isolation. The advisory reports affected versions as langflow 1.1.2–1.10.2, langflow-base 0.1.2–0.10.2, and lfx before 1.10.3.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.