Attackers exploited a Langflow flaw that runs an MCP server's command field as a shell command

What happened

The Hacker News reported, citing Previdian, active exploitation of CVE-2026-105740, rated CVSS 9.9, in Langflow versions before 1.9.0. Any signed-in Langflow user, admin or not, can add an MCP server with the stdio transport, and Langflow passes its command field to bash with no validation, running it whenever the server list loads. Previdian's honeypots logged 1,423 attempts from 27 IP addresses between September 19 and October 15, later 1,706 from 28. In one observed sequence attackers signed in with a common username and password, and other attempts tried to send out Langflow's secret key and superuser password.

Why it matters

The command sits in project settings that normal flow review does not show and runs again on every load, so the same bug gives an attacker persistence. It is the third actively exploited Langflow flaw in this database since August, and one address in this wave had also gone after the two earlier ones and a Flowise bug. Upgrade to 1.10.3 or later, which also fixes a second critical MCP stdio flaw, turn off auto-login, and check requests to the MCP servers endpoint for signs it was used.

Sources

1. The Hacker News Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts October 15, 2026