Full Report
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
Analysis Summary
# Vulnerability: Critical Authenticated RCE in Langflow via MCP Servers
## CVE Details
- **CVE ID:** CVE-2026-105740
- **CVSS Score:** 9.9 (Critical)
- **CWE:** Improper Input Validation / OS Command Injection
## Affected Systems
- **Products:** Langflow (Open-source AI application platform)
- **Versions:** All versions prior to 1.9.0
- **Configurations:** Systems where the Model Context Protocol (MCP) server feature is enabled and reachable by authenticated users.
## Vulnerability Description
The vulnerability exists in the way Langflow handles the addition of Model Context Protocol (MCP) servers using the "stdio" transport. The application accepts a user-supplied command field and passes it directly to `bash -c "exec {command}"` without any validation, allowlisting, or sandboxing. Furthermore, the `env` field allows for arbitrary environment variable injection (e.g., `LD_PRELOAD`, `PATH` overrides). The malicious command is executed automatically whenever the server list is fetched by the application.
## Exploitation
- **Status:** Exploited in the wild. Previdian reported 1,423 honeypot exploit attempts from 27 unique attacker IPs as of October 2026.
- **Complexity:** Low (Requires valid credentials, but can be non-admin accounts).
- **Attack Vector:** Network (Authenticated).
## Impact
- **Confidentiality:** High (Full access to environment variables, secret keys, and local files like `/etc/passwd`).
- **Integrity:** High (Ability to modify configurations and deploy persistent backdoors).
- **Availability:** High (Potential for full server compromise and lateral movement).
## Remediation
### Patches
- **Upgrade to Langflow version 1.9.0 or later**, which addresses the lack of validation in the MCP server configuration.
### Workarounds
- **Disable Auto-Login:** Ensure `auto_login` is disabled to prevent attackers from bypassing initial credential requirements.
- **Enforce Strong Credentials:** Use complex passwords to prevent brute-force attacks observed in the wild.
- **Network Segmentation:** Limit access to the Langflow interface to trusted IP addresses only.
## Detection
- **Indicators of Compromise (IoCs):**
- **IP Address:** `192.255.229[.]92` (Observed attempting environment variable extraction).
- **Command Logs:** Look for unexpected calls to `id`, `whoami`, or Docker commands accessing `/etc/passwd`.
- **API Logs:** Monitor POST requests to `hXXps://<host>/api/v2/mcp/servers/{server_name}` containing shell commands.
- **Network Traffic:** Unexpected outbound connections to `146.70.211[.]112:18764`.
- **Detection Methods:** Audit the Langflow database or configuration for any MCP servers utilizing the `stdio` transport with suspicious shell commands in the `command` field.
## References
- **Vendor Advisory:** [hXXps://github[.]com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2]
- **Previdian Telemetry:** [hXXps://previdian[.]com/CVE-2026-105740#telemetry]
- **Threat Intelligence:** [hXXps://viz.greynoise[.]io/ips/192.255.229.92]