Fala com um especialista
PreçosNotíciasFala com um especialista
Voltar à sala de imprensa
Ameaças

Langflow CVE-2026-105740: Critical Authenticated RCE Under Active Exploitation

Attackers are abusing a CVSS 9.9 flaw in Langflow's MCP server handling to run commands as any logged-in user. Honeypots logged 1,423 attempts, with a sharp spike since 11 October. Upgrade to 1.9.0 now.

4T4Tify Team4Tify
Oct 15, 2026·5 min de leitura
Langflow CVE-2026-105740: Critical Authenticated RCE Under Active Exploitation

Langflow CVE-2026-105740: authenticated RCE now under active exploitation

Attackers are actively going after a critical flaw in Langflow, the open-source low-code platform teams use to build AI applications and agentic workflows. Tracked as CVE-2026-105740 (CVSS 9.9), the bug lets any logged-in user run operating-system commands on the Langflow server. Honeypot data shows exploitation attempts picked up sharply this week.

What happened

The weakness is in how Langflow handles MCP (Model Context Protocol) servers configured with the stdio transport. Versions before 1.9.0 pass the user-supplied command straight to a shell with no allowlist, validation or sandboxing. The command runs as soon as the MCP server list is loaded. Langflow also accepts arbitrary environment variables for these servers (for example LD_PRELOAD or PATH), so an attacker gets a second way to hijack execution.

The key point is that no admin rights are needed. Any ordinary Langflow account can register a malicious MCP server and get code running with the privileges of the Langflow process. The malicious configuration is saved in project settings, so it runs again every time the server list loads, which gives the attacker built-in persistence. It also doesn't appear in the normal flow-editor view, so a routine review of a project can miss it.

According to Previdian, its honeypots have logged 1,423 exploitation attempts since 19 September 2026, from 27 unique IP addresses spread across Europe, Asia, Africa and the Americas. Activity spiked from 11 October, when 333 attempts were recorded in a single day.

How attackers are getting in

Because the flaw requires authentication, the first step is getting a session. The observed pattern:

  • Fingerprint the Langflow version.
  • Try the auto-login endpoint, which hands out a session on instances where auto-login is left on.
  • Where that fails, log in with common or default username/password pairs.
  • Use the resulting token to reach the MCP server configuration endpoint and plant the payload.

The payloads seen so far are reconnaissance and theft. They try to dump environment variables and secrets such as LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD to an external host, run container commands to read host files like /etc/passwd, and run basic probes (id, whoami). One heavily active source address has also been tied to brute-forcing and to exploitation of other Langflow and Flowise vulnerabilities. This looks like opportunistic campaigns targeting AI tooling broadly, not one targeted operation. Attribution to any specific actor has not been established.

Why it matters

AI workflow builders often sit next to valuable assets: model API keys, database credentials, vector stores and internal services. A compromised Langflow server can lead to full host takeover, credential theft and lateral movement, and the persistence mechanism survives restarts. This is also the second critical MCP stdio command-injection issue in Langflow in roughly a month (CVE-2026-105697, also CVSS 9.9), so this attack surface needs ongoing attention.

What to do

  1. Upgrade Langflow to 1.9.0 or later now.
  2. Disable auto-login: set LANGFLOW_AUTO_LOGIN=false.
  3. Enforce strong, unique passwords and remove default or shared accounts. Grant Langflow access only to trusted users.
  4. Don't expose Langflow directly to the internet. Put it behind a VPN, SSO or an authenticating reverse proxy.
  5. Hunt for compromise. Review authentication logs and requests to the MCP server endpoints (/api/v2/mcp/servers/), and inspect project settings for unfamiliar MCP server entries.
  6. Rotate secrets on any instance that was exposed: Langflow secret key, superuser password, and every API key or credential reachable from the host or its environment.
  7. Map your AI tooling footprint. Shadow deployments of AI builders are common. Find them before attackers do.

Not sure whether you have an exposed Langflow instance or other AI tooling on your perimeter? 4Tify's attack-surface monitoring can help you find it.

Reporting credit: this story was first reported by The Hacker News, drawing on honeypot telemetry from Previdian. This article is 4Tify's independent summary and analysis.

PARTILHAR