CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
CVSS Skor
9.9
EPSS İhtimal
%0.5
Risk Skoru
0.0
Yayın
13 gün önce
İlgili Siber Güvenlik Haberleri (Newsroom)
Bu zafiyetin basında ve siber güvenlik yayın organlarında yer aldığı makaleler ve analiz bültenleri:
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
İlgili Benzer Açıklar
9.8
CVE-2025-3248 Aktif sömürülüyorLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Yama doğrulandı Public Exploits:3EPSS %100
9.3
9.8
CVE-2026-42208 Aktif sömürülüyorSQL injection in Litellm
Yama doğrulandı Public Exploits:6EPSS %6
6.5
CVE-2026-48710 Aktif sömürülüyorStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Yama doğrulandı Public Exploits:2EPSS %7
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-105697"