Skip to content
Hacker Posts

Langflow MCP stdio RCE exploited in the wild, fix in 1.9.0

CVE-2026-105740 (CVSS 9.9) lets any authenticated Langflow user run OS commands via an MCP stdio server config; Previdian honeypots logged 1,423 exploit attempts since September 19.

Published 2 min read
cvelangflowai-securityresearch

A critical flaw in Langflow, the open-source AI-workflow builder now owned by IBM, lets any logged-in user — including non-admins — run arbitrary OS commands as the Langflow process. CVE-2026-105740 scores 9.9. The primary source is Langflow's advisory, GHSA-7w94-79vh-5mr2; the fix is in 1.9.0. Honeypot operator Previdian has logged active exploitation since September.

What the bug does

Adding an MCP server with the stdio transport lets a user supply a command field that Langflow passes to bash -c "exec {command}" with no validation, allowlisting, or sandboxing. The command runs when the server list is fetched. The env field allows arbitrary environment-variable injection (LD_PRELOAD, PATH overrides). The malicious MCP config persists in project settings and re-executes every time the list loads, and it is not visible during normal flow review. A sibling bug, CVE-2026-105697 (also 9.9), is the same OS-command-injection class via the MCP stdio config.

Exploitation status

Previdian's sensors recorded 1,423 exploit attempts since September 19 from 27 unique IPs across Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, the Seychelles, Singapore, South Korea, Taiwan, Tanzania, the US and Vietnam — 333 attempts from October 11, 66 as of October 15. Attackers check the version, probe /api/v1/auto_login (disabled in the honeypot, 403), then log in with common credentials before posting the malicious MCP server. Observed payloads pull LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, run Docker commands against the host filesystem, and fire id/whoami probes.

Indicators

From Previdian's writeup (CVE-2026-105740 telemetry), corroborated by GreyNoise:

192.255.229[.]92            top source IP (also tied to Flowise/Langflow brute-force)
146.70.211[.]112:18764      environment-data exfiltration destination
POST /api/v2/mcp/servers/{server_name}
GET  /api/v2/mcp/servers?action_count=true
GET  /api/v1/auto_login

Action checklist

  1. Upgrade to Langflow 1.9.0 or later.
  2. Set LANGFLOW_AUTO_LOGIN=false so unauthenticated callers can't reach the authenticated surface.
  3. Use strong, unique credentials — the observed chain relies on default or guessable logins after auto-login is probed.
  4. Do not expose Langflow to untrusted networks. It is an internal tool, not an internet-facing app.
  5. Review logs for POSTs to /api/v2/mcp/servers/ and connections to the IOCs above.

Context

Langflow RCEs keep landing: this site has already covered CVE-2026-55255 and CVE-2025-34291, both of which reached CISA's KEV catalog. The recurring theme is an AI-tooling project that treats authenticated users as trusted and hands them primitives — here, a raw bash -c — that belong behind a sandbox. If you run any LLM-orchestration tool with a login, assume "authenticated" is not a security boundary until you've checked.

Related stories