From CVE-2026-105697 to CVE-2026-105740: a pattern Langflow did not close
Langflow has now shipped two fixes for the same defect class in its MCP stdio integration. The first, CVE-2026-105697, covered command injection through MCP server configuration and was addressed under advisory GHSA-w794-rj3p-xv45. The second, CVE-2026-105740, affects releases before 1.9.0 and is described in GHSA-7w94-79vh-5mr2. Both carry a CVSS score of 9.9.
What the two advisories have in common
Both describe a user controlled command reaching a shell. Both run with the privileges of the Langflow process. Both belong to the stdio transport, where the platform starts a local process for the MCP server.
A near-identical vulnerability returning after a fix suggests the first fix addressed a symptom. Removing one unsafe path while leaving the general pattern of building a shell command from configuration allows a later change, refactor or new endpoint to reintroduce it.
Why a second occurrence is a design signal
When two vulnerabilities share a root cause, reviewers should ask what invariant the code relies on. Here the invariant appears to be "the command field is trusted." That is not an invariant, it is an assumption, and the advisory language for CVE-2026-105740 states plainly that there is zero validation, no allowlisting and no sandboxing.
The alternative design is unglamorous: an allowlist of launchable executables, argv arrays instead of shell strings, no inheritance of user-supplied environment variables, and a permission gate on who may change server configuration at all.
Operational consequences for the second wave
Teams that remediated the first flaw may have treated MCP configuration as reviewed. It is worth re-checking. A stored command from before the fix is data in project settings, and upgrading the platform does not remove attacker-supplied entries.
- Re-read the MCP server list for shell invocations.
- Verify that the release in service is at or past 1.9.0, not just past the earlier fix.
- Confirm that environments allowing non-admin users to add servers have a reason to.
Exploitation in the wild
Previdian counted 1,423 attempts against its honeypot fleet from September 19 to mid October 2026, from 27 addresses across fifteen countries and territories, with a peak of 333 in a single day on October 11. The operators checked the Langflow version, tried /api/v1/auto_login, and authenticated with common credentials when auto-login was disabled. Captured commands pulled LANGFLOW_SECRET_KEY, LANGFLOW_SUPERUSER_PASSWORD and configuration data, tried Docker-based host access, and read /etc/passwd.
Exposure context
A ZoomEye search for app="Langflow" returned 19,181 assets at the time of writing. These are fingerprint matches and not verified vulnerable installations. Querying vul.cve="CVE-2026-105740" returned 0 indexed assets, which says more about index coverage than about the state of deployed systems.
Remediation
Upgrade to 1.9.0 or later, clear stored MCP entries of anything unexpected, set LANGFLOW_AUTO_LOGIN=false, enforce unique strong passwords, and review requests to /api/v2/mcp/servers/ for the write-then-fetch pattern.
Top comments (0)