All vulnerabilities
CVE-2026-105740CVE-2026-105697GHSA-7w94-79vh-5mr2GHSA-w794-rj3p-xv45PYSEC-2026-4237PYSEC-2026-4239PYSEC-2026-4241

Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

langflow-ai langflowPyPIApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.59%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.10.3Also 0.10.3OSV
Published5 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 1.10.3langflow, PyPIOSVpip install "langflow>=1.10.3"
  • 0.10.3langflow-base, PyPIOSVpip install "langflow-base>=0.10.3"
  • 1.10.3lfx, PyPIOSVpip install "lfx>=1.10.3"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.

Text from CVE List

Affected versions 150

  • langflowaffected: < 1.9.0CVE List
  • langflow, PyPIfrom 1.1.2, fixed in 1.10.3OSV
  • langflow, PyPI1.1.2OSV
  • langflow, PyPI1.1.3OSV
  • langflow, PyPI1.1.4OSV
  • langflow, PyPI1.1.4.post1OSV
  • langflow, PyPI1.10.0OSV
  • langflow, PyPI1.10.0rc0OSV
  • langflow, PyPI1.10.1OSV
  • langflow, PyPI1.10.1rc0OSV
  • langflow, PyPI1.10.1rc3OSV
  • langflow, PyPI1.10.2OSV
  • langflow, PyPI1.10.2rc4OSV
  • langflow, PyPI1.10.3rc0OSV
  • langflow, PyPI1.2.0OSV
  • langflow, PyPI1.3.0OSV
  • langflow, PyPI1.3.1OSV
  • langflow, PyPI1.3.2OSV
  • langflow, PyPI1.3.3OSV
  • langflow, PyPI1.3.4OSV
  • langflow, PyPI1.4.0OSV
  • langflow, PyPI1.4.1OSV
  • langflow, PyPI1.4.2OSV
  • langflow, PyPI1.4.3OSV
  • langflow, PyPI1.5.0OSV
  • langflow, PyPI1.5.0.post1OSV
  • langflow, PyPI1.5.0.post2OSV
  • langflow, PyPI1.5.1OSV
  • langflow, PyPI1.6.0OSV
  • langflow, PyPI1.6.1OSV
  • langflow, PyPI1.6.2OSV
  • langflow, PyPI1.6.3OSV
  • langflow, PyPI1.6.4OSV
  • langflow, PyPI1.6.5OSV
  • langflow, PyPI1.6.6OSV
  • langflow, PyPI1.6.7OSV
  • langflow, PyPI1.6.8OSV
  • langflow, PyPI1.6.9OSV
  • langflow, PyPI1.7.0OSV
  • langflow, PyPI1.7.1OSV
  • langflow, PyPI1.7.2OSV
  • langflow, PyPI1.7.3OSV
  • langflow, PyPI1.8.0OSV
  • langflow, PyPI1.8.0rc0OSV
  • langflow, PyPI1.8.0rc1OSV
  • langflow, PyPI1.8.0rc2OSV
  • langflow, PyPI1.8.0rc3OSV
  • langflow, PyPI1.8.0rc4OSV
  • langflow, PyPI1.8.0rc5OSV
  • langflow, PyPI1.8.0rc6OSV
  • langflow, PyPI1.8.1OSV
  • langflow, PyPI1.8.2OSV
  • langflow-base, PyPIfrom 0.1.2, fixed in 0.10.3OSV
  • langflow-base, PyPI0.1.2OSV
  • langflow-base, PyPI0.1.3OSV
  • langflow-base, PyPI0.1.4OSV
  • langflow-base, PyPI0.1.4.post1OSV
  • langflow-base, PyPI0.10.0OSV
  • langflow-base, PyPI0.10.0rc0OSV
  • langflow-base, PyPI0.10.1OSV
  • langflow-base, PyPI0.10.1rc0OSV
  • langflow-base, PyPI0.10.1rc3OSV
  • langflow-base, PyPI0.10.2OSV
  • langflow-base, PyPI0.10.2rc4OSV
  • langflow-base, PyPI0.10.3rc0OSV
  • langflow-base, PyPI0.2.0OSV
  • langflow-base, PyPI0.3.0OSV
  • langflow-base, PyPI0.3.1OSV
  • langflow-base, PyPI0.3.2OSV
  • langflow-base, PyPI0.3.3OSV
  • langflow-base, PyPI0.3.4OSV
  • langflow-base, PyPI0.4.0OSV
  • langflow-base, PyPI0.4.1OSV
  • langflow-base, PyPI0.4.2OSV
  • langflow-base, PyPI0.4.3OSV
  • langflow-base, PyPI0.5.0OSV
  • langflow-base, PyPI0.5.0.post1OSV
  • langflow-base, PyPI0.5.0.post2OSV
  • langflow-base, PyPI0.5.1OSV
  • langflow-base, PyPI0.6.0OSV
  • langflow-base, PyPI0.6.1OSV
  • langflow-base, PyPI0.6.2OSV
  • langflow-base, PyPI0.6.3OSV
  • langflow-base, PyPI0.6.4OSV
  • langflow-base, PyPI0.6.5OSV
  • langflow-base, PyPI0.6.6OSV
  • langflow-base, PyPI0.6.7OSV
  • langflow-base, PyPI0.6.8OSV
  • langflow-base, PyPI0.6.9OSV
  • langflow-base, PyPI0.7.0OSV
  • langflow-base, PyPI0.7.1OSV
  • langflow-base, PyPI0.7.2OSV
  • langflow-base, PyPI0.7.3OSV
  • langflow-base, PyPI0.8.0OSV
  • langflow-base, PyPI0.8.0rc0OSV
  • langflow-base, PyPI0.8.0rc1OSV
  • langflow-base, PyPI0.8.0rc2OSV
  • langflow-base, PyPI0.8.0rc3OSV
  • langflow-base, PyPI0.8.0rc4OSV
  • langflow-base, PyPI0.8.0rc5OSV
  • langflow-base, PyPI0.8.0rc6OSV
  • langflow-base, PyPI0.8.1OSV
  • langflow-base, PyPI0.8.2OSV
  • lfx, PyPIfrom first release, fixed in 1.10.3OSV
  • lfx, PyPI0.1.0OSV
  • lfx, PyPI0.1.1OSV
  • lfx, PyPI0.1.10OSV
  • lfx, PyPI0.1.11OSV
  • lfx, PyPI0.1.13OSV
  • lfx, PyPI0.1.2OSV
  • lfx, PyPI0.1.3OSV
  • lfx, PyPI0.1.4OSV
  • lfx, PyPI0.1.5OSV
  • lfx, PyPI0.1.6OSV
  • lfx, PyPI0.1.7OSV
  • lfx, PyPI0.1.8OSV
  • lfx, PyPI0.1.9OSV
  • lfx, PyPI0.2.0OSV
  • lfx, PyPI0.2.1OSV
  • lfx, PyPI0.2.2OSV
  • lfx, PyPI0.3.0OSV
  • lfx, PyPI0.3.0rc0OSV
  • lfx, PyPI0.3.0rc1OSV
  • lfx, PyPI0.3.0rc2OSV
  • lfx, PyPI0.3.0rc3OSV
  • lfx, PyPI0.3.0rc4OSV
  • lfx, PyPI0.3.0rc5OSV
  • lfx, PyPI0.3.0rc6OSV
  • lfx, PyPI0.3.1OSV
  • lfx, PyPI0.3.2OSV
  • lfx, PyPI0.3.3OSV
  • lfx, PyPI0.3.3rc0OSV
  • lfx, PyPI0.3.4OSV
  • lfx, PyPI0.4.0OSV
  • lfx, PyPI0.4.1OSV
  • lfx, PyPI0.4.2OSV
  • lfx, PyPI0.4.3OSV
  • lfx, PyPI0.4.3rc0OSV
  • lfx, PyPI0.4.4OSV
  • lfx, PyPI0.4.5OSV
  • lfx, PyPI0.4.6OSV
  • lfx, PyPI0.4.6rc0OSV
  • lfx, PyPI1.10.0OSV
  • lfx, PyPI1.10.0rc0OSV
  • lfx, PyPI1.10.1OSV
  • lfx, PyPI1.10.1rc0OSV
  • lfx, PyPI1.10.1rc3OSV
  • lfx, PyPI1.10.2OSV
  • lfx, PyPI1.10.2rc4OSV
  • lfx, PyPI1.10.3rc0OSV

References 4