{
  "id": 16879458,
  "title": "From CVE-2026-105697 to CVE-2026-105740: a pattern Langflow did not close",
  "url": "https://urgent.news/2026/10/28/from-cve-2026-105697-to-cve-2026-105740-a-pattern-langflow-did-not",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T09:40:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/stark_zhuang_df5076f35c68/from-cve-2026-105697-to-cve-2026-105740-a-pattern-langflow-did-not-close-6o6"
  },
  "original_language": "en",
  "account": "Two severe vulnerabilities, CVE-2026-105697 and CVE-2026-105740, were discovered in Langflow's MCP stdio integration. Both vulnerabilities allow user-controlled commands to execute with the privileges of the Langflow process and belong to the stdio transport, which starts a local process for the MCP server. Despite sharing similarities, the two advisories represent distinct issues.\n\nCVE-2026-105697 addressed command injection through MCP server configuration, which was fixed under advisory GHSA-w794-rj3p-xv45. CVE-2026-105740, affecting releases before 1.9.0, was detailed in GHSA-7w94-79vh-5mr2. Both vulnerabilities carry a high CVSS score of 9.9.\n\nThe second vulnerability's occurrence suggests that the initial fix only addressed a symptom, as the underlying assumption of trusting the command field persisted. To prevent future reintroduction, a more robust design is needed, including an allowlist of executable commands, argv arrays instead of shell strings, no inheritance of user-supplied environment variables, and strict control over who can modify server configuration.\n\nOrganizations that remediated the first flaw may need to re-evaluate their MCP configuration reviews. The second vulnerability allows attackers to exploit stored commands from before the fix, which are embedded in project settings. Therefore, upgrading to version 1.9.0 or later and clearing any unexpected stored MCP entries is crucial.\n\nExploitation attempts have been observed, with 1,423 attacks against Langflow's honeypot fleet between September 19 and mid-October 2026. Captured commands targeted sensitive information like LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, attempted Docker-based host access, and read critical system files. Organizations should review their Langflow versions, invalidate auto-login configurations, enforce strong passwords, and scrutinize requests to /api/v2/mcp/servers/ for potential vulnerabilities.",
  "summary": "From CVE-2026-105697 to CVE-2026-105740: a pattern Langflow did not close Langflow has now shipped two fixes for the same defect class in its MCP stdio integration. The first, CVE-2026-105697, covered command injection through MCP server configuration and was addressed under advisory GHSA-w794-rj3p-xv45. The second, CVE-2026-105740, affects releases before 1.9.0 and is described in…",
  "key_points": [
    "Two CVEs discovered in Langflow's MCP stdio integration",
    "Upgrading to version 1.9.0 or later and clearing stored MCP entries recommended"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}