Skip to content
HACKTECH
AI securityReported Published 6 sources

Langflow flaw turning MCP server settings into shell commands draws exploit attempts

Langflow, a tool for building and deploying AI-powered agents and workflows, let any authenticated user add a Model Context Protocol (MCP) server whose stdio command was passed to a shell without validation, giving remote code execution on the host (CVE-2026-105740, CVSS 9.9, fixed in 1.9.0). A related advisory for CVE-2026-105697 says that with the default auto-login setting the auto-login endpoint hands out a token without credentials, and lists 1.10.3 as the patched release. The Hacker News, citing Previdian honeypot data, reported 1,423 exploitation attempts from 27 IP addresses between 19 September and 15 October 2026, later updated to 1,706 from 28 addresses, including attempts to extract LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD.

  • Langflow
  • MCP
  • CVE-2026-105740
  • CVE-2026-105697
  • remote code execution
  • AI agents

What the sources report

  • CVE-2026-105740 (Langflow advisory GHSA-7w94-79vh-5mr2, published 10 September 2026) affects Langflow before 1.9.0: the MCP stdio command field is passed to bash -c with no validation, allowlisting or sandboxing and runs when the server list is fetched, and the env field allows injection of variables such as LD_PRELOAD or PATH overrides.
  • GitHub advisory GHSA-w794-rj3p-xv45 (CVE-2026-105697, CVSS 9.9) covers langflow from 1.1.2 up to but not including 1.10.3: version 1.9.0 added a command allowlist at the REST model level, and 1.10.3 applied the same validation at the execution sink and removed the bash -c wrapper.
  • The advisory says that with the default LANGFLOW_AUTO_LOGIN enabled, GET /api/v1/auto_login hands out a token without credentials (auto-login is documented as development-only), and that with it disabled any authenticated non-admin user can still exploit the flaw.
  • In one sequence Previdian observed, attackers checked the Langflow version, tried /api/v1/auto_login, logged in with a common username and password and immediately used the bearer token on the MCP server configuration endpoint; activity ramped up from 11 October 2026, when 333 attempts were recorded.
  • When checked on 9 November 2026, Previdian's tracker listed 11,462 attempts from 57 unique attacker IP addresses in 24 countries, noted that attempts do not show targets were vulnerable or that attacks succeeded, and said the CVE was not listed in CISA KEV.
  • BleepingComputer reported in July 2026 that CISA added Langflow's CVE-2026-55255 to its Known Exploited Vulnerabilities catalogue. As of catalogue version 2026.11.06 (6 November 2026), CISA lists six Langflow flaws as exploited: CVE-2025-3248 (added May 2025), CVE-2026-33017 (March 2026), CVE-2025-34291 (May 2026), CVE-2026-55255 (July 2026), CVE-2026-0770 (July 2026) and CVE-2026-9198 (August 2026, listed under IBM); CVE-2026-105740 and CVE-2026-105697 are not listed (BleepingComputer, CISA KEV data).

What it means for your organisation

In vulnerable Langflow releases an MCP stdio server definition is a shell command that any authenticated user can write and the host will run, and it was reachable through development defaults and common passwords on internet-facing instances. CISA's Known Exploited Vulnerabilities catalogue already listed six other Langflow flaws. If a vulnerable instance was reachable, treat everything in its environment, including the keys and passwords attackers were seen trying to extract, as exposed.

What we check

  • Discover internet-facing Langflow and other AI workflow builders, and confirm Langflow instances run 1.10.3 or later.
  • Confirm LANGFLOW_AUTO_LOGIN is false outside development and that default or common credentials are rejected at login.
  • Test whether non-admin accounts can create or edit MCP server definitions or use the MCP Tools component, and whether stdio commands are limited to an allowlist.
  • Review logs for requests to /api/v2/mcp/servers/ and unexpected child processes on Langflow hosts, and rotate LANGFLOW_SECRET_KEY, the superuser password and any API keys in the environment if exposure is found.

Sources

Services that cover these checks

  • AI & LLM application testing

    Adversarial testing of features built on large language models: chat assistants, retrieval-augmented search, agents with tool access, and generated output that reaches users or other systems. We test whether the model can be steered into leaking data, taking actions it should not, or passing untrusted output into the rest of your stack.

    Duration: 4 to 10 working days

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works