Harden mcp stdio servers
An MCP server using stdio transport is a command line that your agent runs as you. In October 2026 this was no longer abstract: Langflow's CVE-2026-105740 (CVSS 9.9) allowed any logged-in user to register a stdio server whose command went straight to bash -c . This post walks through the bug, the fix that really holds up, and an audit of a development machine…
Langflow, a company, had a vulnerability in their MCP server, which allowed any authenticated user to register a server with a command that would run directly on the system. This vulnerability, known as CVE-2026-105740, had a CVSS score of 9.9 and was patched in version 1.9.0. The bug allowed users to define what command to run, not just how to parse the string, and was caused by the lack of an allowlist of permitted commands and a blocklist of dangerous commands.
According to reports, there have been thousands of attempts to exploit this vulnerability since September 19.
Written by urgent.news from Dev.to's report — not a translation of it. Machine-written — may contain errors; check the original before relying on it.
