CVE-2026-105697

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105740

Langflow versions prior to 1.9.0 are vulnerable to Remote Code Execution (RCE) via the MCP Stdio transport . An authenticated user can execute arbitrary OS commands because the user-supplied command field is passed directly to bash -c "exec {command}" without validation, allowlisting, or sandboxi...

CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697

Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...

CVE-2026-42271-PoC

CVE-2026-42271 — MCP stdio 테스트 엔드포인트를 통한 LiteLLM 인증된 명령 주입 LiteLLM POST /mcp-rest/test/connection 및 POST /mcp-rest/test/tools/list — MCP stdio 전송 방식을 통한 인증된 명령 주입. 유효한 API 키만 있으면 기본 Docker 배포에서 root 권한으로 임의의 OS 명령을 실행할 수 있습니다. 이미지는 digest로 고정됨 : 취약한 컨테이너는 LiteLLM v1.82.6 으로 고정되어 장기간 재현이 가능합니다. 필드...

mcp-stdio-shellguard

StudioMeyer MCP Stack의 일부 — 마요르카에서 제작 🌴 · 사용한다면 ⭐ mcp-stdio-shellguard MCP stdio 서버를 위한 심층 방어Defense-in-depth 번들입니다. childprocess.exec/spawn을 허용 목록allowlist + 샌드박스sandbox + 재생 감지replay-detection로 래핑하고, MCP 서버 소스에서 정화sanitize되지 않은 셸 호출을 스캔하는 AST 감사 CLImcp-shellguard-audit도 포함합니다. Ox-Security MCP...

mcpshield

mcpshield 패치되지 않은 MCP STDIO 명령 주입 결함CVE-2026-30623 계열, 2026년 4월 OX Security가 "설계상by design"으로 공개 -- SDK 패치는 제공되지 않음을 위한 드롭인 수정입니다. 한 줄만 임포트하면 Python 앱이 시작하는 모든 stdio MCP 서버는 OS가 프로세스를 생성하기 전에 명령/인자/env가 검증됩니다. 처음 방문했다면 먼저 범위를 읽고, 설치와 시작하기를 따라 하면 2분 안에 보호받을 수 있습니다. 목차 프로젝트 상태 범위 설치 시작하기 옵션 A: 자동 패...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 인증되지 않은 RCE MCP stdio 환경변수 주입 1.10.1까지의 Langflow OSS에서 발생하는 인증되지 않은 원격 코드 실행 취약점입니다. MCP stdio 서버 구성을 보호하는 환경변수 블랙리스트DANGEROUSENVVARS에 SHELLOPTS, BASHOPTS, PS4가 누락되어 있습니다. MCP stdio 런처가 구성된 명령어를 bash -c로 실행하기 때문에, 공격자는 SHELLOPTS=xtrace와 PS4 명령어 치환을 주입하여...

EUVD-2026-83658

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

PT-2026-95912

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description A command injection flaw exists in the MCP STDIO Server Management component within the subprocess.Popen function of the backend/aiops/services.py file. A remote attacker can exploit this...

CVE-2026-93965: Improper Neutralization of Special Elements used in a Command

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-90898

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898

Bifrost (by maximhq) is vulnerable to unauthenticated remote code execution through its MCP stdio client registration endpoint. When a stdio client is registered via POST /api/mcp/client, Bifrost immediately spawns the specified command in the gateway—no MCP handshake required. By default, authen...

CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-78575

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575

IBM Langflow OSS 1.0.0–1.11.5 is vulnerable to OS command injection (CWE-78) in the MCP stdio server configuration , allowing a remote authenticated attacker to execute arbitrary commands. The root cause involves two gaps: the MCP stdio validator on Windows recognizes only one cmd.exe execution s...