Langflow, the open-source workflow platform for building AI applications, has been exposed to a severe authenticated remote code execution (RCE) vulnerability. The issue, tracked as CVE-2026-105740 with a CVSS score of 9.9, affects all versions prior to 1.9.0. Any authenticated user—even without admin privileges—can execute arbitrary OS commands via misuse of its MCP server configuration using the “stdio” transport. Key server commands and environment variables can be injected without any sandboxing, validation, or allowlisting.
How the Vulnerability Works
The design flaw centers around how Langflow handles user-supplied ‘command’ and ‘env’ fields when defining MCP servers. The ‘command’ is passed directly to a shell invocation (“bash -c exec {command}”), and the ‘env’ field enables injection of arbitrary environment variables — for example, overriding LD_PRELOAD or PATH. The attack vector unfolds after a user posts a crafted MCP server (via HTTP POST to “/api/v2/mcp/servers/{server_name}”) and later fetches the list of MCP servers (via HTTP GET to “/api/v2/mcp/servers?action_count=true”), triggering execution.
Real-World Exploitation: Honeypot Data Reveals Early Attacks
Since September 19, 2026, sensors deployed by threat intelligence firm Previdian have recorded 1,423 exploit attempts against honeypots mimicking vulnerable Langflow deployments. These came from 27 distinct IP addresses spanning multiple countries, including China, Germany, Nigeria, Russia, the U.S., and Vietnam. Exploitation activity saw a spike starting October 11, with 333 attempts in one day; 66 attempts were noted on October 15.
Analysis of observed attack behavior shows that attackers are taking steps first to authenticate—even using common credentials—before leveraging the vulnerability via bearer tokens. Exploits include attempts to extract environment settings such as LANGFLOW_SECRET_KEY and SUPERUSER_PASSWORD, probing host files like “/etc/passwd”, and deploying reverse shells or simple commands like “id” and “whoami”. One IP address in particular—192.255.229.92—was highly active in attempts to pull environment variables.
Mitigation & Recommendations
Langflow has issued a patch in version 1.9.0 that resolves the issue. Administrators unable to upgrade immediately should disable auto-login, enforce strong, unique passwords, and restrict who can access the vulnerable MCP server endpoint. It’s also advised to avoid exposing Langflow to untrusted networks and to monitor authentication logs and requests to “/api/v2/mcp/servers/”.
Just last month, a similarly critical vulnerability—CVE-2026-105697—was patched. It likewise allowed OS command injection via flawed MCP stdio server configuration. This indicates a pattern of dangerous misuse of server configuration endpoints in Langflow’s architecture.
This vulnerability matters because Langflow is designed for building and managing AI agent workflows—tools increasingly embedded in production environments. When platforms permit execution of arbitrary commands via misconfigured endpoints, all downstream applications and data become risk vectors. Anyone running Langflow in multi-user or exposed environments is at risk until patched. What to watch: how swift adoptions of 1.9.0 are, whether threat actors move from honeypot to widespread real-world exploitation, and whether similar patterns emerge in related AI orchestration platforms. Monitor platforms like Langflow carefully—they promise productivity, but faulty configuration, especially in AI infrastructure, can easily hand over the keys to attackers.
