Langflow RCE flaw allows authenticated users to execute shell commands

Threat actors are actively exploiting a critical remote code execution vulnerability in Langflow, an open-source platform for building AI applications. Security firm Previdian reported that attackers have launched over 1,400 exploitation attempts against honeypot sensors since mid-September 2026. The flaw, identified as CVE-2026-105740, affects versions of Langflow prior to 1.9.0 and allows any authenticated user to execute arbitrary operating system commands on the host server.

What happened

The vulnerability stems from how Langflow handles Model Context Protocol (MCP) server configurations. When a user adds an MCP server using the 'stdio' transport, the application accepts a command field without validation, allowlisting, or sandboxing. This command is passed directly to the shell via bash -c "exec {command}". Consequently, any user with valid credentials, including non-admin accounts, can inject malicious payloads. The command executes immediately when the server list is fetched, granting the attacker the same privileges as the Langflow process.

Previdian’s data reveals a surge in activity, with 333 attempts recorded on October 11, 2026, alone. In total, 1,423 exploitation attempts were detected from 27 unique IP addresses across countries including China, Russia, the U.S., and Vietnam. Attackers typically authenticate using weak or common credentials after checking the Langflow version. Once inside, they send crafted HTTP POST requests to the MCP server endpoint to store their payload, then trigger execution by fetching the server list.

The consequences of successful exploitation are severe. Attackers can achieve full server compromise, inject environment variables like LD_PRELOAD, and deploy persistent backdoors. Because MCP server configs are stored in project settings rather than visible flow components, these malicious configurations can remain hidden during normal code reviews. Captured payloads show attackers attempting to extract sensitive secrets such as LANGFLOW_SECRET_KEY and reading host filesystem files like /etc/passwd.

How it works

The core mechanism relies on the lack of input sanitization for the MCP stdio transport. In a typical attack chain, the adversary first logs in as a standard user. They then send a POST request to /api/v2/mcp/servers/{server_name} containing a malicious command in the body. Langflow stores this configuration without checking if the command is safe. To trigger the exploit, the attacker sends a GET request to /api/v2/mcp/servers?action_count=true. This action forces the application to load the server list, which inadvertently executes the stored command in the background.

This method is particularly dangerous because it bypasses traditional code review processes. Unlike custom Python components that appear in the visual editor, MCP configurations are backend settings. Furthermore, the vulnerability allows for environment variable injection, enabling attackers to manipulate the runtime environment of the Langflow process. This can facilitate lateral movement within the network or establish persistent access, as the malicious config re-executes every time the server list is accessed.

Key details

• Vulnerability ID: CVE-2026-105740 with a CVSS score of 9.9.
• Affected Versions: All Langflow versions prior to 1.9.0.
• Attack Vector: Authenticated remote code execution via MCP server configuration.
• Exploitation Volume: 1,423 attempts recorded by Previdian since September 19, 2026.
• Primary Target: Weak credentials are used to gain initial access before exploiting the flaw.
• Persistence: Malicious MCP configs remain in project settings and re-execute on list fetches.

Why it matters

For engineering teams building AI workflows, this incident highlights the risks of integrating complex protocol handlers like MCP without strict security boundaries. The fact that a non-admin user can compromise the entire host underscores the importance of least-privilege access controls. Many organizations may assume that internal users or collaborators are trusted, but this vulnerability turns any compromised account into a gateway for full server takeover. It also demonstrates how configuration interfaces can become attack surfaces if not properly sandboxed.

Additionally, the rapid escalation in exploitation attempts suggests that automated scanners are now targeting this specific flaw. The involvement of IP addresses linked to other recent vulnerabilities in tools like Flowise indicates a systematic campaign against AI development infrastructure. Teams running exposed Langflow instances must treat this as an active threat, not just a theoretical risk. The ability to extract secret keys and environment variables means that a single breach can lead to wider infrastructure compromise.

What you can do

• Upgrade Langflow to version 1.9.0 or later immediately to patch CVE-2026-105740.
• Disable auto-login by setting LANGFLOW_AUTO_LOGIN=false in your environment variables.
• Enforce strong, unique passwords for all Langflow user accounts to prevent unauthorized access.
• Review authentication logs and monitor requests to /api/v2/mcp/servers/ for suspicious activity.
• Avoid exposing Langflow instances directly to untrusted networks or the public internet.
• Restrict Langflow account creation to trusted personnel only and audit existing user permissions.