LANGFLOW has a critical authenticated remote code execution flaw, tracked as CVE-2026-105740 (CVSS 9.9), affecting versions prior to 1.9.0. Security researchers at Previdian report that any authenticated Langflow user can trigger RCE by adding an MCP server configured with the stdio transport. The vulnerability stems from a user-supplied command being passed directly to bash -c "exec {command}" with no validation, allowlisting or sandboxing, so the command executes when the server list is fetched.
The env field also permits arbitrary environment variable injection (for example LD_PRELOAD or PATH manipulation), enabling further exploitation. In practice, an attacker can log in as a normal user, create a malicious MCP server via a crafted HTTP POST to /api/v2/mcp/servers/{server_name} containing a malicious command, then trigger execution by issuing a GET to /api/v2/mcp/servers?action_count=true to load the list, which executes the embedded payload. Langflow notes that MCP server configurations are stored in project settings and are not visible during standard flow reviews, increasing stealth.
Evidence from Previdian's honeypots shows 1,423 exploitation attempts since 19 September 2026 across 27 attacker IPs from multiple countries, with a notable ramp beginning on 11 October 2026 and 66 attempts observed on 15 October 2026. Reported payloads include attempts to read environment variables and sensitive Langflow data (e.g., LANGFLOW_SECRET_KEY, LANGFLOW_SUPERUSER_PASSWORD), Docker commands to access host files, and commands like id or whoami.
Mitigations urged by Previdian and Langflow include upgrading to patched versions, disabling auto-login, enforcing strong, unique passwords, and reviewing authentication logs and /api/v2/mcp/servers activity for suspicious requests. A related critical vulnerability, CVE-2026-105697, was also addressed by Langflow prior to this advisory. Where patching isn’t possible, LANGFLOW_AUTO_LOGIN should be set to false and exposure to untrusted networks should be avoided.