Langflow Remote Code Execution Flaw Risks Server Control
The critical vulnerability affects versions prior to 1.9.0, allowing attackers to inject commands and gain persistent access.
Updated on Oct. 15, 2026 in Cybersecurity
Live Poll
Do you trust the security of open-source AI tools you use for your own projects?
Langflow versions prior to 1.9.0 are vulnerable to CVE-2026-105740, an authenticated remote code execution flaw carrying a critical CVSS score of 9.9. Security researchers have tracked 1,423 exploitation attempts targeting the software since September 19, 2026.
Why it matters
The vulnerability allows attackers to gain full server control and establish persistent backdoors, exposing critical infrastructure integrated with the workflow tool. This follows a previous high-severity flaw in the platform, highlighting significant risks in Langflow's command execution logic.
The flaw, CVE-2026-105740, earns a 9.9 CVSS score for its potential for full server compromise. It follows a similarly critical 9.9-rated vulnerability, CVE-2026-105697, that the platform previously addressed.
The players
Langflow
A workflow automation platform for AI agents now owned by IBM through its acquisition of DataStax.
DataStax
A database-as-a-service provider specializing in Apache Cassandra that acquired Langflow in February 2025.
IBM
A global technology giant that integrated Langflow into its stack following the acquisition of DataStax in February 2025.
The details
The vulnerability triggers when authenticated users add a malicious Model Context Protocol (MCP) server with stdio transport containing a command payload. Langflow then passes user-supplied command fields to bash -c without performing validation, allowlisting, or sandboxing. This oversight causes the server to execute the malicious payload immediately upon fetching the MCP server list via a GET request, resulting in environment variable injection.
Timeline
September 19, 2026: Previdian began recording exploitation attempts.
October 11, 2026: Exploitation activity peaked with 333 attempts recorded.
October 15, 2026: Researchers observed 66 distinct exploitation attempts.
The Tech Race
The discovery follows the recent remediation of CVE-2026-105697, another 9.9-rated vulnerability in the platform. This repeated security failure suggests ongoing challenges in hardening Langflow's execution environment against command injection.
Users must audit their environments and ensure they have updated to Langflow version 1.9.0 or later to patch the execution vulnerability. Administrators should also monitor for suspicious MCP server configurations that may indicate a persistent backdoor.
The takeaway
Organizations running Langflow should immediately prioritize patching to version 1.9.0 to mitigate the risk of server takeover. Security teams should monitor logs for unusual GET requests associated with MCP server list fetches, as these are the primary vector for exploitation.
Further reading
For broader trends in enterprise software safety, see Cybersecurity.
Live Poll
Do you trust the security of open-source AI tools you use for your own projects?
