A critical vulnerability in Langflow, an open-source platform for building AI applications, is under active exploitation. Tracked as CVE-2026-105740 with a CVSS score of 9.9, the flaw allows any authenticated user, including non-admin accounts, to achieve remote code execution on the server. The issue lies in how Langflow handles MCP servers using the stdio transport: a user-supplied command is passed directly to bash -c without validation, allowlisting, or sandboxing. Fetching the server list triggers execution immediately.
According to security firm Previdian, 1,423 exploit attempts have been recorded against its honeypot sensors since September 19, 2026, originating from 27 unique IP addresses across 15 countries. Activity ramped up sharply on October 11 with 333 attempts in a single day. In one observed sequence, attackers checked the Langflow version, tried the auto-login endpoint, and then authenticated using common credentials before hitting the vulnerable MCP configuration endpoint.
Captured payloads include attempts to exfiltrate environment variables such as LANGFLOW_SECRET_KEY, Docker commands to read /etc/passwd, and simple probes like id and whoami. One IP address, 192.255.229.92, has also been linked to brute-force attacks and exploitation of other Langflow and Flowise flaws, suggesting a systematic campaign. Langflow patched the issue in version 1.9.0 and also addressed a related critical command injection vulnerability, CVE-2026-105697. Until patching is possible, administrators should disable auto-login, enforce strong passwords, and review logs for requests to /api/v2/mcp/servers/.