Exploit attempts hit Langflow flaw that runs any command via MCP

Exploit attempts hit Langflow flaw that runs any command via MCP

15 October 2026: Attackers have started probing CVE-2026-105740, a critical flaw in Langflow, the open-source tool for building AI agents and workflows, that lets any signed-in user run operating system commands on the server. Previdian, which runs a network of honeypot sensors, showed 1,434 attempts against the flaw from 13 source addresses on the morning of 15 October, nearly all of them new since its previous period.

Not yet independently verified. The exploitation attempts are one security firm's honeypot counts; Langflow has not reported exploitation and the flaw is not in CISA's Known Exploited Vulnerabilities catalogue as of 14 October. We will update this when either changes. We will update this when it can be confirmed, and remove this note.

Langflow's advisory, GHSA-7w94-79vh-5mr2, rates the flaw 9.9 out of 10 and lists 1.9.0 as the patched version. It was published on 10 September and last updated on 5 October.

How an ordinary account gets a shell

Langflow lets users connect Model Context Protocol servers to their flows. One transport, stdio, starts the MCP server as a local process. According to the advisory, the command field for that process went to bash with no validation, no allow list and no sandbox, and the environment field accepted values such as LD_PRELOAD or a changed PATH. Any authenticated user could do this, not only an administrator.

The command runs when Langflow fetches the list of MCP servers, and the configuration is saved in the project's settings, so it runs again when other users or administrators open the project. On a shared Langflow server, one compromised or careless account is enough.

Which version is actually safe

Version 1.9.0 closed the first route. A second advisory, GHSA-w794-rj3p-xv45 (CVE-2026-105697), published on 28 September, describes another command injection through the same MCP stdio feature, fixed only in 1.10.3. The same day Langflow published a critical advisory for unsandboxed code execution in its Python REPL component, fixed in 1.10.1. The current release, 1.12.6, came out on 13 October.

An upgrade to 1.9.0 alone therefore leaves known holes. Anything older than 1.10.3 is exposed to at least one critical command injection.

A product attackers already watch

Langflow is a familiar target. CISA's Known Exploited Vulnerabilities catalogue already holds six Langflow entries, starting with the missing-authentication flaw CVE-2025-3248 added in May 2025 and most recently CVE-2026-9198 in August 2026. Servers that face the internet are the ones the sensors see being probed. Restricting who can create accounts, keeping the interface off the public internet and reviewing projects for MCP servers nobody recognises all reduce exposure while the upgrade is scheduled.

Langflow is maintained by DataStax, which IBM acquired in 2025. Our machine learning software category includes DataRobot, Anaconda and Azure Machine Learning.

Related on TrustList:

• SAP patches a CVSS 10 token flaw in its Cloud SDK for Python
• MCP Python SDK clients could hand OAuth secrets to a hostile server: upgrade to 1.30.0 or 2.2.0 and set the issuer

Sources

• Langflow: GHSA-7w94-79vh-5mr2, Authenticated RCE via MCP Stdio transport (updated 5 October 2026), 10 September 2026
• Langflow: GHSA-w794-rj3p-xv45, OS command injection via MCP stdio, 28 September 2026
• Previdian: Sensor-observed exploitation attempts (read 15 October 2026), 15 October 2026
• Langflow releases: v1.12.6, 13 October 2026