Langflow authenticated remote code execution flaw drawing thousands of exploit attempts through unvalidated MCP server commands

Previdian warned of exploitation of CVE-2026-105740, a flaw rated 9.9 in Langflow, the open-source platform for building AI applications and agentic workflows now owned by IBM. Any authenticated user can add an MCP server using the stdio transport, and the user-supplied command is passed to bash with no validation, allowlisting, or sandboxing, running when the server list is fetched. Previdian recorded 1,706 exploit attempts from 28 IPs since September 19, with payloads trying to extract the Langflow secret key and superuser password and read the host passwd file. Versions prior to 1.9.0 are affected, and operators should update to the latest release.

Check

Update Langflow to the latest release, restrict who can add MCP servers, and place Langflow instances behind authentication and network controls rather than exposing them publicly.

Affected

Langflow versions before 1.9.0 let any authenticated user run arbitrary commands by adding an MCP server with the stdio transport, and exploitation attempts are widespread.

Fix

Upgrade Langflow, remove public exposure, rotate the Langflow secret key and superuser password, and review hosts for command execution and environment variable theft.