CVE-2026-105740

Langflow MCP settings allow server command execution

Langflow / IBM · Langflow MCP

First documented disclosure · Review checkpoint

Summary

Ordinary authenticated users could configure MCP stdio commands that run with the server’s privileges.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Reported activity: Previdian reports sensor-observed exploitation attempts from September 19 through October 26. This is evidence of attempts, not confirmed customer intrusions.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

MCP configuration accepted unrestricted commands and environment settings; listing servers could trigger execution.

Conditions required

A valid Langflow account with access to the vulnerable MCP settings path.

Potential impact

Server code execution and access to secrets held by the service.

Affected versions and configurations

Before 1.9.0 for the settings route; related execution paths had broader exposure.

Fix and mitigation status

1.9.0 for this route; related flow/tweak boundaries require Langflow/lfx 1.10.3 and langflow-base 0.10.3.

Practical next steps

Upgrade the relevant packages, disable automatic login, and restrict who can configure executable MCP servers.

Operating lesson

A connector configuration is executable authority and needs explicit authorization.

Evidence and limits

September 10 is the upstream advisory date; October 5 is CVE publication. Sensor attempts do not establish customer compromises.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources