Langflow, the open-source platform for building agent flows, has a remote command execution flaw (CVE-2026-105740, CVSS 9.9) that any authenticated user can trigger without being an administrator. Previdian's honeypots have logged 1,423 exploitation attempts since September 19.
How the Flaw Works
Langflow lets you plug MCP servers into an agent flow. With the "Stdio" transport, the MCP server is really just a local command. In versions before 1.9.0, the command field submitted by the user was passed to bash -c "exec {command}" with no validation, allowlist or sandbox. The env field also accepts arbitrary variables, which opens the door to tricks like LD_PRELOAD or replacing PATH.
The flow described by The Hacker News has two steps. First, a regular (non-admin) user sends a POST to /api/v2/mcp/servers/{name} with the malicious command, and the configuration is stored as-is. Then a GET to /api/v2/mcp/servers?action_count=true lists the servers and, in doing so, runs the command. Because the configuration is saved in the project settings, it runs again every time the list loads and isn't visible in a normal review of the flow.
What the Honeypots Saw
According to the Previdian alert cited by The Hacker News (October 15, 2026), the honeypot logged 1,423 attempts since September 19, coming from 27 IP addresses in 15 countries. Activity picked up on October 11, with 333 attempts in a single day; the figure was later updated to 1,706 attempts from 28 IPs.
The pattern is that of an attacker who doesn't depend on a login bug: they check the Langflow version, try /api/v1/auto_login (which the honeypot had disabled and which returned 403), sign in with a common credential and use the token against the vulnerable endpoint. The observed payloads looked for environment variables such as LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD to send them to an external server, Docker commands to reach the host filesystem, reads of /etc/passwd, and id and whoami probes.
Why It Matters Beyond Langflow
This isn't the first MCP Stdio flaw on the same platform: THN mentions CVE-2026-105697, another command injection through MCP server configuration (CVSS 9.9, fixed in 1.10.3), and the most active IP has also been linked to attacks on Flowise (CVE-2026-69255) and other Langflow flaws. The pattern is structural: when an agent orchestrator lets the user define "which command starts the tool," that feature is, by design, code execution. The security question becomes who can create MCP servers and with what privileges the process runs.
How to Mitigate It
- Update to a fixed version (1.9.0 or later; also check the fix for CVE-2026-105697).
- Disable auto-login (
LANGFLOW_AUTO_LOGIN=false) and require unique, strong passwords. - Don't expose Langflow to untrusted networks, and limit accounts to trusted people.
- Review authentication logs and requests to
/api/v2/mcp/servers/. - Rotate
LANGFLOW_SECRET_KEYand the superuser credentials if there was any exposure.