Attackers Exploit Langflow MCP Command Injection in the Wild (CVE-2026-105740)

Key Takeaways

• CVE-2026-105740 lets any authenticated Langflow user run shell commands by adding an MCP server.
• The flaw is rated CVSS 9.9 and affects Langflow versions before 1.9.0.
• Honeypots recorded 1,706 exploit attempts from 28 IP addresses, surging after October 11.
• Captured payloads tried to steal Langflow secret keys and superuser passwords.
• Default credentials and auto-login settings make exposed instances easier to hit.

An MCP Setting Became a Shell Prompt

Langflow, a popular open-source platform for building AI agents and workflows, is under active attack through a command injection flaw in its MCP server configuration. As The Hacker News reported, honeypot exploit attempts climbed sharply in mid-October, with attackers hunting for the secrets that control Langflow deployments.

What We Know

Langflow published an advisory for CVE-2026-105740 in September 2026. The flaw carries a CVSS score of 9.9 and affects all versions before 1.9.0, according to a technical analysis from The Hacker Wire.

Exploit attempts against honeypots began September 19. Activity jumped on October 11, with 333 attempts that day, and reached 1,706 attempts from 28 unique IP addresses by mid-October. Security firm Previdian published the alert. Attackers logged in using common usernames and passwords, then attempted to read LANGFLOW_SECRET_KEY, LANGFLOW_SUPERUSER_PASSWORD, and host files such as /etc/passwd. At least one source IP also targeted older Flowise and Langflow flaws.

What Happened

Langflow lets users connect agents to tools through the Model Context Protocol. One MCP option, the stdio transport, starts a local process from a command the user supplies. Langflow passed that command field straight into a bash shell with no validation, allowlist, or sandbox, and it ran whenever the server list loaded. The env field also accepted arbitrary environment variables, enabling tricks such as LD_PRELOAD or PATH overrides.

The result is code execution for any authenticated user, not just administrators. Weak or default credentials close the remaining gap. This is a traditional injection bug amplified by an AI-era design choice: agent builders are expected to wire in new tools quickly, so the platform treats tool configuration as trusted input.

Why It Matters

Langflow servers often hold API keys for model providers, databases, and SaaS tools that agents use. A compromised instance can expose those credentials and every workflow built on them. Because Langflow is self-hosted, many organizations may not know which teams run it or whether it faces the internet.

Repeated exploitation of Langflow over 2026 shows attackers now treat AI workflow platforms as standard targets. Patching to 1.9.0, disabling auto-login, and limiting accounts to trusted users are immediate steps.

PointGuard AI Perspective

Treat every MCP server definition as executable code. The PointGuard AI MCP Security Gateway centralizes MCP connections and enforces which servers and tools each agent may use, so a user cannot quietly register a local process that runs arbitrary commands.

PointGuard AI Security Posture Management discovers self-hosted AI platforms such as Langflow, flags vulnerable versions and risky settings like auto-login, and highlights instances exposed to untrusted networks. Our blog MCP Breaks Zero Trust. Here's How to Fix It. explains why MCP connections need verification rather than assumed trust. Secure agent development starts with knowing where these platforms run and what they can reach.

Incident Scorecard Details

Total AISSI Score: 7.2/10

Criticality: 8, Langflow servers hold provider keys and workflow secrets that unlock connected systems. AISSI weighting: 25%

Propagation: 7, Compromise spreads to the agents, tools, and credentials each instance connects through MCP. AISSI weighting: 20%

Exploitability: 8, Active exploitation attempts are confirmed in honeypots from multiple actors. AISSI weighting: 15%

Supply Chain: 7, Risk sits in a widely used open-source agent framework that teams self-host. AISSI weighting: 15%

Business Impact: 6, No confirmed victim breach yet, but exposed instances face sustained attacks. AISSI weighting: 25%

Sources

Third-Party Sources

• The Hacker News: Langflow's Critical Authenticated RCE Under Active Exploitation
• The Hacker Wire: CVE-2026-105740 Langflow Critical RCE via Stdio Transport

PointGuard AI Sources

• PointGuard AI MCP Security Gateway
• PointGuard AI Security Posture Management
• PointGuard AI Blog: MCP Breaks Zero Trust. Here's How to Fix It.