Langflow CVE-2026-105740: RCE via Authenticated MCP Stdio, 2,023 Exploitation Attempts Observed

wpnews.pro

#

Basic Information

This is a severe vulnerability with a CVSS score of 9.9, allowing low-privileged accounts to achieve code execution on the server. Although observed by a single sensor, continuous exploitation attempts have been recorded from 28 source IPs across 16 countries, including Japan.

#

Quick Summary

In Langflow before 1.9.0, authenticated low-privileged users can save MCP Stdio commands, which execute arbitrary commands with the privileges of the Langflow process when a list retrieval request with action_count=true is called. Previdian observed 2,023 exploitation attempts starting September 19, 2026, as of the October 17 verification.

#

Attack Flow

Path 1: RCE via MCP Stdio from Low-Privileged Account

The attacker authenticates using a low-privileged Langflow account.
They add an MCP server using the Stdio transport method, configuring and saving the execution command and optional environment variables (env ).
When GET /api/v2/mcp/servers?action_count=true retrieves the list with action counts, Langflow passes the savedcommand without validation to abash -c process execution. Note that not all standard list retrievals without query parameters trigger execution.
Arbitrary OS commands run with the execution privileges of the Langflow process, leading to the retrieval of additional payloads or the discovery of secrets within the environment.

#

Attacker Position and Execution Location

A low-privileged remote user who can log into Langflow. In environments accessible from the internet, leaked credentials or improperly created accounts serve as an initial foothold.

#

Victim and Administrator Perspective

Victim / User: Because it appears as normal workflow editing or MCP server addition, regular user screens may not display clear warnings. #

Administrator: Can be observed as the registration of MCP Stdio settings, abash process starting immediately after a list retrieval withaction_count=true , modification of environment variables, and outbound communication to unknown destinations.

#

Success and Failure Conditions

Success Conditions

Ability to authenticate with a valid account against Langflow versions prior to 1.9.0.
Low-privileged users must be able to save MCP Stdio settings and trigger the launch of a bash child process on the Langflow server. Execution is triggered by list retrieval withaction_count=true .

Failure Conditions and Mitigations

Update Langflow to 1.9.0 or later and restrict the use of MCP Stdio to essential administrators only.
Reduce unnecessary internet exposure, shared accounts, and long-lived API keys, and run the Langflow process itself in a low-privileged, sandboxed environment.

#

What Happens Upon Success

Execution of arbitrary OS commands on the Langflow server.
Potential unauthorized access to connected connector credentials, AI model API keys, workflow data, or subsequent discovery within the same network.

#

Observable Logs

Below are potential investigation targets within your organization. Availability depends on products, permissions, log settings, and retention periods; the absence of records does not prove the absence of a breach.

Email: No email vectors specific to this issue have been identified. #

Proxy / SWG / DNS: Distinguish and check POST requests adding MCP Stdio settings from`GET /api/v2/mcp/servers?action_count=true` requests, and investigate subsequent child processes or outbound communications. Note that attacks do not necessarily generate external callback traffic. #

Endpoint / EDR: Check records of`bash` ,`sh` ,`curl` ,`wget` , or similar tools launched from Langflow or Python processes, as well as changes to environment variables such as`LD_PRELOAD` or`PATH` . #

Identity / IdP: Check for the creation of new low-privileged accounts, logins from unknown sources, and API key usage history. #

SaaS / Cloud: Check change histories for workflows, MCP servers, connectors, and secrets, along with usage statuses of connected AI models and cloud API keys. #

Network: Check the Langflow host for DNS queries to unknown destinations, HTTP traffic, reverse shells, or other communications.

#

Attack Success Determination

Confirmed in Public Information

Exploitation attempts observed (success unconfirmed): Public information: Previdian's honeypot sensor observed 2,023 exploitation attempts. The success or failure of command execution and subsequent compromises in production organizations cannot be confirmed solely through this telemetry. Scope: Observations from a single sensor between September 19 and October 17, 2026.

Separate contact, execution, persistence, data access, and exfiltration; do not infer unconfirmed success from a single alert.

#

Investigation Playbook

Investigation Starting Point: Start with deployments of Langflow before 1.9.0, suspicious MCP Stdio configuration saves, or`bash` execution by the Langflow process. #

Initial Verification: Check the running version, scope of internet exposure, used accounts, contents of saved MCP server`command` and`env` settings, and the execution time and user of list retrievals with`action_count=true` . The user who saved the setting and the user who triggered the list retrieval may not be the same. #

Device and Server Investigation: Preserve the process tree, shell history, environment variables, downloaded files, temporary directories, and container-host boundary settings. #

Authentication and Cloud Investigation: Check Langflow accounts, API keys, connector credentials, and usage history of tokens for model providers. #

Subsequent Actions: Track secret discovery, additional payload deployment, internal network scanning, unauthorized cloud API usage, and data exfiltration. #

Containment: Isolate the target service from the network, update to 1.9.0 or later, revoke suspicious accounts and API keys, and remove unauthorized MCP Stdio settings. #

Determination Categories: Evaluate scan traffic, logins, MCP setting saves, command execution, secret access, and external communication in separate stages.

#

Defense and Detection Ideas

Single Event: Detect events where`bash -c` or download utilities are launched from Langflow or Python processes with high priority. #

Time-Series Correlation: Correlate logins using low-privileged accounts, saving MCP Stdio settings, list retrievals with`action_count=true` ,`bash` execution, and outbound traffic in chronological order. #

Threat Hunting: Search all internal Langflow environments for versions, internet exposure status, MCP Stdio configurations, shared accounts, and suspicious child processes on hosts. #

Log Limitations: Because Previdian's public telemetry lacks details on requested paths, User-Agents, and callback host details, internal application logs and EDR logs must be cross-referenced. #

Priority Mitigations: Prioritize updating to version 1.9.0, restricting permissions for the MCP Stdio feature, sandboxing the host side, and rotating saved credentials.

#

Facts / Inference / Hypothesis

Facts

In Langflow before 1.9.0, MCP Stdio command values saved by authenticated users are passed directly tobash -c execution without prior validation, allowlists, or sandboxing when list retrieval withaction_count=true occurs.
Saved command values are executed via list retrieval specifyingaction_count=true , and this request is also called when viewing MCP settings in the management console. Because settings are persisted, they re-execute whenever list retrieval matching these conditions occurs. Environment variable injection such asLD_PRELOAD orPATH via theenv field is also possible.
Previdian observed initial exploitation attempts on September 19, 2026, recording a cumulative total of 2,023 attempts, 28 source IP addresses, and 16 countries as of the October 17 verification.
This observation is based on a single honeypot sensor. Although source countries include Japan, this does not mean organizations within Japan suffered damage.
CVE-2026-105740 is registered with a CVSS v3.1 score of 9.9 as CWE-78, and was patched in Langflow 1.9.0. Previdian's public page noted it as not listed on CISA KEV as of October 17.
The CVE CNA record defines affected versions as prior to 1.9.0. Additionally, the GitHub advisory package field lists 1.8.3, and the fixed version field lists 1.9.0.

Inference

Because publicly available exploitation observations are records of attempts against a single honeypot, the arrival of attack requests and successful compromises in production organizations must be evaluated separately. Combining monitoring for leaked or improperly created low-privileged accounts with audits of MCP setting changes improves the accuracy of detecting actual harm.

Hypothesis

No additional hypotheses. Unconfirmed items are noted in "Unknowns and Additional Investigation".

#

MITRE ATT&CK Mapping

#

Unknowns and Additional Investigation

Specific payload contents observed by Previdian, callback destinations, attacker objectives, the number of successful compromises in production organizations, and the breakdown of duplication or automated scanning within the 2,023 attempts cannot be confirmed from public information.

#

Impact on SOCs and Organizations

Because AI workflow platforms connect closely with credentials for external services and internal data connectors, the impact of remote code execution (RCE) on servers extends beyond the Langflow host alone. Organizations running Langflow should prioritize reviewing internet exposure, promptly updating to version 1.9.0 or later, auditing permissions for low-privileged accounts and API keys, and correlating MCP Stdio settings with host-level child process creation logs.

#

Summary by Target Audience

For SOCs: Correlate MCP Stdio configuration saves, list retrievals with`action_count=true` ,`bash` execution by Langflow, environment variable injection, and outbound traffic over time. Include cases in which a different user triggers list retrieval after the settings were saved. #

For Administrators: Update Langflow to 1.9.0 or later, restrict unnecessary internet exposure and MCP Stdio features, and inventory registered accounts and API keys. #

For Users: Do not reuse credentials for management consoles or shared accounts, and promptly report any unfamiliar MCP server settings to administrators if found.

source & further reading

dev.to — original article I gave an AI my job hunt. Here's the system that kept it honest. Your Copilot Model Migration Needs a Rehearsal, Not a New Dropdown MailMate AI Desktop — Open-Source Email Assistant That Summarizes, Prioritizes, and Creates Tasks Locally