SB2026061242 - Multiple vulnerabilities in Langflow
Published: June 12, 2026 Updated: October 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2025-62718)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to conduct server-side request forgery and disclose sensitive information.
The vulnerability exists due to improper hostname normalization in NO_PROXY rule evaluation when processing attacker-controlled request URLs. A remote attacker can supply a crafted URL using forms such as localhost. or [::1] to conduct server-side request forgery and disclose sensitive information.
Applications that rely on NO_PROXY entries for loopback or internal services are affected.
2) OS Command Injection (CVE-ID: CVE-2026-105740)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary OS commands on the server with the privileges of the Langflow process.
The vulnerability exists due to improper neutralization of OS commands in Langflow's MCP Stdio transport when processing user-supplied server configurations. A remote user can submit a malicious command through POST /api/v2/mcp/servers/{server_name} and trigger its execution through bash -c by requesting GET /api/v2/mcp/servers?action_count=true to execute arbitrary OS commands on the server.
The malicious server configuration persists and can trigger execution again when other users or administrators load the server list. The configuration also accepts environment variables that can override PATH or inject shared libraries through LD_PRELOAD on Linux.
Remediation
Install update from vendor's website.