# Langflow Authenticated RCE via MCP Server stdio Transport (CVE-2026-105740) Under Active Exploitation

> Langflow versions prior to 1.9.0 let any authenticated user achieve remote code execution by adding an MCP server with 'stdio' transport; the user-supplied command is passed to bash -c with no validation, allowlisting or sandboxing. Previdian honeypots recorded 1,423 exploitation attempts from 27 IPs in 15 countries between 2026-09-19 and 2026-10-15 (peak of 333 on 2026-10-11).

- **Published:** 2026-10-15T09:41:56Z
- **Last reviewed:** 2026-10-15T09:41:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3602
- **ID:** TL-2026-3602
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-105740, CVE-2026-105697

## Description

CVE-2026-105740 (GHSA-7w94-79vh-5mr2, CVSS 9.9, CWE-78) affects Langflow, the open-source platform for building AI applications and agentic workflows (acquired by IBM from DataStax in February 2025). Any authenticated user, including non-admin accounts, can add an MCP (Model Context Protocol) server using the 'Stdio' transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting and no sandboxing. The env field also permits arbitrary environment variable injection (for example LD_PRELOAD or a PATH override). The command runs with the privileges of the Langflow process and re-executes whenever the server list is fetched.

The documented exploit flow is: authenticate as a regular user and obtain a JWT; send a crafted HTTP POST to /api/v2/mcp/servers/{server_name} containing the malicious stdio configuration; then trigger execution with HTTP GET /api/v2/mcp/servers?action_count=true. The advisory reporter is AbdrrahimDahmani. The fix is in Langflow 1.9.0 (commit efbc4a16e639409d938a4883463d27ef0bc637a0, PR #12290). A sibling flaw, CVE-2026-105697 (GHSA-w794-rj3p-xv45, CVSS 9.9), covers the same MCP stdio command-execution surface in versions >=1.1.2 and <1.10.3 and is exploitable without credentials when LANGFLOW_AUTO_LOGIN is enabled (the default).

Previdian honeypot telemetry shows exploitation beginning 2026-09-19 03:14 UTC, about two weeks before the CVE was published (2026-10-05). Attackers first check the Langflow version, try the /api/v1/auto_login endpoint, and then brute-force common username/password pairs. Observed payloads include id and whoami reconnaissance, Docker commands that target the host filesystem and /etc/passwd, and commands that exfiltrate LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD environment variables to 146.70.211.112:18764. The primary attacker IP 192.255.229.92 also ran extensive brute-force activity and has been tied to attacks on Flowise (CVE-2026-69255) and other Langflow CVEs (CVE-2026-55255, CVE-2026-9198, CVE-2026-0768). Previdian lists the CVE as exploited but it is not in CISA KEV as of 2026-10-15. No formal public PoC reference is listed, although the advisory contains reproduction steps.

Impact is full server compromise: theft of secrets and API keys held in the Langflow environment, access to connected AI pipelines and data sources, container escape attempts, and lateral movement.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T1110.001 Brute Force: Password Guessing
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable
- T1611 Escape to Host
- T1552 Unsecured Credentials
- T1033 System Owner/User Discovery
- T1005 Data from Local System

## Sources

- [Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts](https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html)
- [GitHub Security Advisory GHSA-7w94-79vh-5mr2](https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2)
- [Previdian CVE-2026-105740 exploitation telemetry](https://previdian.com/CVE-2026-105740)
- [OpenCVE: CVE-2026-105740](https://app.opencve.io/cve/CVE-2026-105740)
- [OpenCVE: CVE-2026-105697 (related MCP stdio command injection, GHSA-w794-rj3p-xv45)](https://app.opencve.io/cve/CVE-2026-105697)
- [Mend.io Vulnerability Database: CVE-2026-105740](https://www.mend.io/vulnerability-database/CVE-2026-105740/)
- [TheHackerWire: CVE-2026-105740 Langflow critical RCE](https://www.thehackerwire.com/cve-2026-105740-langflow-critical-rce-authenticated-command-injection-via-stdio-transport/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3602