From CVE-2026-105697 to CVE-2026-105740: a pattern Langflow did not close

Two severe vulnerabilities, CVE-2026-105697 and CVE-2026-105740, were discovered in Langflow's MCP stdio integration. Both vulnerabilities allow user-controlled commands to execute with the privileges of the Langflow process and belong to the stdio transport, which starts a local process for the MCP server. Despite sharing similarities, the two advisories represent distinct issues.

CVE-2026-105697 addressed command injection through MCP server configuration, which was fixed under advisory GHSA-w794-rj3p-xv45. CVE-2026-105740, affecting releases before 1.9.0, was detailed in GHSA-7w94-79vh-5mr2. Both vulnerabilities carry a high CVSS score of 9.9.

The second vulnerability's occurrence suggests that the initial fix only addressed a symptom, as the underlying assumption of trusting the command field persisted. To prevent future reintroduction, a more robust design is needed, including an allowlist of executable commands, argv arrays instead of shell strings, no inheritance of user-supplied environment variables, and strict control over who can modify server configuration.

Organizations that remediated the first flaw may need to re-evaluate their MCP configuration reviews. The second vulnerability allows attackers to exploit stored commands from before the fix, which are embedded in project settings. Therefore, upgrading to version 1.9.0 or later and clearing any unexpected stored MCP entries is crucial.

Exploitation attempts have been observed, with 1,423 attacks against Langflow's honeypot fleet between September 19 and mid-October 2026. Captured commands targeted sensitive information like LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, attempted Docker-based host access, and read critical system files. Organizations should review their Langflow versions, invalidate auto-login configurations, enforce strong passwords, and scrutinize requests to /api/v2/mcp/servers/ for potential vulnerabilities.