Tag archive

Langflow

Coverage tagged langflow.

Langflow MCP Stdio Flaws Give Any Logged-In User a Shell: CVE-2026-105697 and CVE-2026-105740

Two CVSS 9.9 command-injection flaws in Langflow's MCP stdio transport let a low-privileged user run host commands. Fixed in 1.10.3; no exploitation reported.

Related desks

AI Security

Latest

Oct 6, 2026, 10:31 AM EDT · AI Security · Mistral6 minMistral Large 4 preview ships a reduced-moderation cyber tier, and Artificial Analysis lists its 82% as the top score

Mistral Large 4 is in preview, with vetted partners and states getting a reduced-moderation cyber tier. Artificial Analysis lists its 82% CyberGym score as the top of 18 models.

Oct 5, 2026, 9:42 PM EDT · AI Security · Langflow5 minLangflow MCP Stdio Flaws Give Any Logged-In User a Shell: CVE-2026-105697 and CVE-2026-105740

Two CVSS 9.9 command-injection flaws in Langflow's MCP stdio transport let a low-privileged user run host commands. Fixed in 1.10.3; no exploitation reported.

Oct 5, 2026, 5:33 AM EDT · AI Security · Cve 2026 1040195 minAWS Patches Critical SageMaker Distribution Flaw That Lets a Project Contributor Hijack Another User's Studio Space

AWS disclosed CVE-2026-104019 on 2 October 2026 (bulletin 2026-125-AWS), an OS command injection in the Studio Space startup validation script of Amazon SageMaker Distribution as used by SageMaker Unified Studio. An authenticated project contributor can run commands in another project member's Space and take that member's temporary execution role credentials. The CNA scores it 9.0 (CVSS 3.1) and 9.3 (CVSS 4.0). AWS lists no workaround, and two older release families get no fix. We found no report of exploitation.

Oct 5, 2026, 5:24 AM EDT · AI Security · Aws Loom6 minAWS fixes Loom flaw that gave any network client admin rights on deployments without an identity provider

AWS Loom before 1.6.1 treated every client as super-admin with no identity provider set (CVE-2026-103956). Upgrade to 1.7.4; 1.7.0 fixes two SSRF flaws.