CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105740

Langflow versions prior to 1.9.0 are vulnerable to Remote Code Execution (RCE) via the MCP Stdio transport . An authenticated user can execute arbitrary OS commands because the user-supplied command field is passed directly to bash -c "exec {command}" without validation, allowlisting, or sandboxi...

CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

EUVD-2026-92799

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

CVE-2026-105699

Langflow versions 1.6.8 through 1.9.1 are vulnerable to an authenticated cross-project file disclosure due to unscscoped MCP resource handlers. The application validates project identifiers but fails to authorize the resource URI provided to resources/read. Consequently, an attacker can bypass pr...

CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-105697

Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

mcp-attack-detection-sentinel

Обнаружение MCP-атак — Sentinel Research Lab Sentinel-исследования по обнаружению MCP Model Context Protocol паттернов атак: необычный доступ к идентификационным данным после MCP-события, мутация определений инструментов, межресурсный доступ и возможное поведение после эксплуатации. Правила...

mcpjam-cve-2026-23744-validator

Validateur de sécurité autorisé MCPJam Inspector Un validateur de preuve de concept limité pour CVE-2026-23744 affectant les déploiements vulnérables de MCPJam Inspector. Ce projet est un outil de validation indépendant et non destructif pour la CVE-2026-23744 précédemment divulguée. Il ne s'agit...

masq

Sit where the model sits. See what it can see. MASQ MASQ is a local security CLI for AI agent stacks. It sits in the same seat the model sits in: it reads MCP tool catalogs, completes the MCP handshake, looks through session logs, and probes local model HTTP ports. Then it prints findings and...

CVE-2026-52618

CVE-2026-52618 — @webfer/mcp-ansible-drupal: OS command injection via executeDeployment extra vars spawncmd0, cmd.slice1, shell: true re-joins an argument array into a single /bin/sh -c string without escaping, so a shell metacharacter in an extraVars value supplied to the executeDeployment MCP...

POC-CVE-2026-93680

Описание Код эксплойта proof of concept для CVE-2026-93680 Использование Шаг 1: Подключение к MCP SSE терминал 1 Шаг 2: Инициализация сессии MCP и вывод списка инструментов MCP терминал 2 Шаг 3: Обход аутентификации и эксфильтрация данных терминал 1, вывод результата шага 2...

CVE-2026-52616

CVE-2026-52616 — mcp-nmap-server: OS command injection via runnmapscan The runnmapscan MCP tool builds its command by string interpolation of the target and additionalFlags parameters and runs it through childprocess.exec, i.e. /bin/sh -c. ⚠ Read this first — duplicate identifier This vulnerabili...