Langflow MCP命令注入漏洞被指已在野利用

Previdian 将 Langflow 的命令注入漏洞 CVE-2026-105740 标记为已在野利用，称其传感器观测到相关利用尝试。该漏洞影响 1.9.0 之前的 Langflow：任何已认证用户添加使用 Stdio 传输的 MCP 服务器时，用户提供的 command 字段会被直接交给 bash -c 执行，没有校验、白名单或沙箱，并在服务器列表被获取时立即运行，env 字段还可注入任意环境变量。漏洞已在 1.9.0 修复，CVE 于 2026 年 10 月 5 日发布。Previdian 称其传感器自 2026 年 9 月 19 日起观测到 1,016 次利用尝试和 24 个攻击者 IP，涉及 12 个国家，该漏洞 CVSS 评分为 9.9。

Langflow versions before 1.9.0 have an OS command injection vulnerability CVE-2026-105740, with a CVSS score of 9.9 and a public PoC available. Any authenticated user can achieve remote code execution by adding an MCP server using the Stdio transport; the user-supplied command field is passed directly to bash -c for execution, with no validation, no whitelist, and no sandbox, and it executes immediately when fetching the server list; the env field also allows injecting arbitrary environment variables such as LD_PRELOAD and PATH overrides. The vulnerability is fixed in 1.9.0, and EPSS gives a 0.59% probability of exploitation within 30 days; it is currently not listed in the CISA KEV catalog.