OS Command Injection in Langflow - CVE-2026-105740
Published: October 16, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary OS commands on the server with the privileges of the Langflow process.
The vulnerability exists due to improper neutralization of OS commands in Langflow's MCP Stdio transport when processing user-supplied server configurations. A remote user can submit a malicious command through POST /api/v2/mcp/servers/{server_name} and trigger its execution through bash -c by requesting GET /api/v2/mcp/servers?action_count=true to execute arbitrary OS commands on the server.
The malicious server configuration persists and can trigger execution again when other users or administrators load the server list. The configuration also accepts environment variables that can override PATH or inject shared libraries through LD_PRELOAD on Linux.