Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.
The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of authenticated remote code execution impacting versions prior to 1.9.0.
"Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the 'stdio' transport," reads an advisory released last month.
"The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override)."
The crux of the vulnerability is that Langflow accepts a user-provided command without restricting it to approved executables. This, in turn, can lead to shell execution.
In a hypothetical attack scenario, a bad actor can exploit the flaw in the following fashion -
- Login as a regular, non-admin user.
- Add a malicious MCP server by sending a crafted HTTP POST request to "/api/v2/mcp/servers/{server_name}" with a command field containing a malicious payload (e.g., a reverse shell).
- The server accepts and stores the attacker-supplied "command" without any validation.
- Trigger the flaw by fetching the MCP server list via an HTTP GET "/api/v2/mcp/servers?action_count=true" request, causing the command to execute.
- Achieve code execution.
"Any authenticated Langflow user (including non-admin accounts) can execute arbitrary OS commands on the server with the privileges of the Langflow process," Langflow warned.
Successful exploitation can result in full server compromise, environment variable injection, facilitate lateral movement, and the deployment of a persistent backdoor, as the malicious MCP server configuration persists and re-executes every time the server list is loaded.
"Unlike custom component code which is visible in the flow editor, MCP server configs are stored in project settings and are not visible during normal flow review," Langflow said.
Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.
The exploitation efforts ramped up starting October 11, 2026, when 333 attempts were registered. As of writing, 66 attempts have been observed on October 15, 2026.
"We've investigated how attackers are authenticating, as this vulnerability requires authentication," Ryan Dewhurst, founder and CEO of Previdian, told The Hacker News.
"In one observed sequence, attackers checked the Langflow version, attempted /api/v1/auto_login (which returned 403 as it was disabled in our honeypot), and then successfully authenticated using a common username and password. They immediately used the resulting bearer token to access the vulnerable MCP server configuration endpoint."
Some of the captured payloads include -
- Attempts to extract environment variables and sensitive Langflow configurations, including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, and transmit them to 146.70.211[.]112:18764.
- Docker commands attempting to access the host filesystem and read the contents of "/etc/passwd."
- Command execution probes using id, whoami, and other simple commands.
A significant chunk of the activity originates from the IP address "192.255.229[.]92," which has been observed attempting to extract environment variables. Data from GreyNoise shows that the IP address has engaged in generic brute-force attacks, as well as exploiting other flaws in Flowise (CVE-2026-69255) and Langflow (CVE-2026-55255, CVE-2026-9198, and CVE-2026-0768).
"We recommend upgrading Langflow to a patched version, disabling auto-login, enforcing strong and unique passwords, and reviewing authentication logs and requests to /api/v2/mcp/servers/ for suspicious activity," Dewhurst said.
Last month, Langflow also addressed another critical vulnerability (CVE-2026-105697, CVSS score: 9.9) that could also result in operating system command injection through MCP stdio server configuration.
If immediate patching is not an option, it's advised to set LANGFLOW_AUTO_LOGIN=false, avoid exposing Langflow directly to untrusted networks, and grant Langflow accounts to trusted users.