Threat reportVulnerabilityTL-2026-3602
Langflow Authenticated RCE via MCP Server stdio Transport (CVE-2026-105740) Under Active Exploitation
Langflow Authenticated RCE via MCP Server stdio Transport (TL-2026-3602), also tracked as GHSA-7w94-79vh-5mr2, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-10-15. It has no confirmed attribution, affects Langflow (IBM / DataStax) Langflow, references 2 CVEs (CVE-2026-105740, CVE-2026-105697), maps to 10 MITRE ATT&CK techniques (T1005, T1033, T1059.004), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3602
- Threat ID
- TL-2026-3602
- Also known as
- GHSA-7w94-79vh-5mr2
- Severity
- CRITICAL
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, ai-ml, software-development, cloud
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Langflow Authenticated RCE via MCP Server stdio Transport
Malware and tooling: Python
How Langflow Authenticated RCE via MCP Server stdio Transport works
Langflow versions prior to 1.9.0 let any authenticated user achieve remote code execution by adding an MCP server with 'stdio' transport; the user-supplied command is passed to bash -c with no validation, allowlisting or sandboxing. Previdian honeypots recorded 1,423 exploitation attempts from 27 IPs in 15 countries between 2026-09-19 and 2026-10-15 (peak of 333 on 2026-10-11).
CVE-2026-105740 (GHSA-7w94-79vh-5mr2, CVSS 9.9, CWE-78) affects Langflow, the open-source platform for building AI applications and agentic workflows (acquired by IBM from DataStax in February 2025). Any authenticated user, including non-admin accounts, can add an MCP (Model Context Protocol) server using the 'Stdio' transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting and no sandboxing. The env field also permits arbitrary environment variable injection (for example LD_PRELOAD or a PATH override). The command runs with the privileges of the Langflow process and re-executes whenever the server list is fetched.
The documented exploit flow is: authenticate as a regular user and obtain a JWT; send a crafted HTTP POST to /api/v2/mcp/servers/{server_name} containing the malicious stdio configuration; then trigger execution with HTTP GET /api/v2/mcp/servers?action_count=true. The advisory reporter is AbdrrahimDahmani. The fix is in Langflow 1.9.0 (commit efbc4a16e639409d938a4883463d27ef0bc637a0, PR #12290). A sibling flaw, CVE-2026-105697 (GHSA-w794-rj3p-xv45, CVSS 9.9), covers the same MCP stdio command-execution surface in versions >=1.1.2 and <1.10.3 and is exploitable without credentials when LANGFLOW_AUTO_LOGIN is enabled (the default).
Previdian honeypot telemetry shows exploitation beginning 2026-09-19 03:14 UTC, about two weeks before the CVE was published (2026-10-05). Attackers first check the Langflow version, try the /api/v1/auto_login endpoint, and then brute-force common username/password pairs. Observed payloads include id and whoami reconnaissance, Docker commands that target the host filesystem and /etc/passwd, and commands that exfiltrate LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD environment variables to 146.70.211.112:18764. The primary attacker IP 192.255.229.92 also ran extensive brute-force activity and has been tied to attacks on Flowise (CVE-2026-69255) and other Langflow CVEs (CVE-2026-55255, CVE-2026-9198, CVE-2026-0768). Previdian lists the CVE as exploited but it is not in CISA KEV as of 2026-10-15. No formal public PoC reference is listed, although the advisory contains reproduction steps.
Impact is full server compromise: theft of secrets and API keys held in the Langflow environment, access to connected AI pipelines and data sources, container escape attempts, and lateral movement.
MITRE ATT&CK techniques used in TL-2026-3602
Collection
Discovery
T1033 System Owner/User Discovery
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1110.001 Brute Force: Password Guessing; T1552 Unsecured Credentials
stealth
T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
Defense Evasion
T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable
Privilege Escalation
Affected products and versions in Langflow Authenticated RCE via MCP Server stdio Transport
- Langflow (IBM / DataStax) — Langflow
Vulnerable versions: <1.9.0 (>=1.8.0.dev0 per NVD CPE; 1.8.3 named in advisory)
Fixed in: 1.9.0
Remediation for Langflow Authenticated RCE via MCP Server stdio Transport
Patches
- Langflow 1.9.0 (fix for CVE-2026-105740)
- Langflow 1.10.3 (fix for CVE-2026-105697)
Immediate actions
- Upgrade Langflow to 1.9.0 or later (1.10.3 or later also addresses sibling CVE-2026-105697)
- Set LANGFLOW_AUTO_LOGIN=false
- Block 192.255.229.92 and 146.70.211.112 at the perimeter and review egress logs for connections to 146.70.211.112:18764
- Rotate LANGFLOW_SECRET_KEY, LANGFLOW_SUPERUSER_PASSWORD and any API keys or credentials stored in the Langflow environment on exposed instances
- Review requests to /api/v2/mcp/servers/ for unexpected stdio server definitions
Workarounds
- Restrict network access to the /api/v2/mcp/ endpoints at a reverse proxy
- Remove or disable MCP stdio server functionality for non-admin users where possible
Longer-term hardening
- Do not expose Langflow to untrusted networks; place it behind VPN or an authenticating reverse proxy
- Restrict Langflow accounts to trusted users and enforce strong unique passwords
- Run Langflow in a least-privilege, sandboxed container without access to the Docker socket or host filesystem
- Alert on shell child processes spawned by the Langflow process
CVEs associated with Langflow Authenticated RCE via MCP Server stdio Transport
Weaknesses (CWE) in Langflow Authenticated RCE via MCP Server stdio Transport
Timeline of Langflow Authenticated RCE via MCP Server stdio Transport
- IBM acquires DataStax, the then-owner of Langflow (February 2025; day not specified in source)
- Previdian honeypot records first exploitation attempt against CVE-2026-105740 at 03:14 UTC, about two weeks before the CVE is published
- CVE-2026-105740 and sibling CVE-2026-105697 are published; GHSA-7w94-79vh-5mr2 advisory is released and Langflow 1.9.0 contains the fix
- CVE-2026-105740 record modified (CVSS 3.1 vector and CWE-78 recorded)
- Exploitation attempts peak at 333 in one day; Previdian confirms active exploitation at 17:42 UTC
- The Hacker News reports 1,423 honeypot attempts from 27 IPs in 15 countries; 66 attempts recorded that day; CVE not listed in CISA KEV
Sources cited for Langflow Authenticated RCE via MCP Server stdio Transport
- Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
- GitHub Security Advisory GHSA-7w94-79vh-5mr2
- Previdian CVE-2026-105740 exploitation telemetry
- OpenCVE: CVE-2026-105740
- OpenCVE: CVE-2026-105697 (related MCP stdio command injection, GHSA-w794-rj3p-xv45)
- Mend.io Vulnerability Database: CVE-2026-105740
- TheHackerWire: CVE-2026-105740 Langflow critical RCE
Detection coverage for TL-2026-3602
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3602 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.