Vulnerabilities

Langflow MCP flaw under attack: a backdoor in settings

By Yaali. October 26, 2026, 6 min read, Vulnerabilities, AI security, Patching.

Langflow CVE-2026-105740 lets any user plant a command that reruns each time the MCP server list loads. Honeypots see attacks. Patch to 1.10.3 and check.

Langflow, the open-source platform for building AI agents and workflows, has a critical flaw in the way it starts Model Context Protocol (MCP) servers. MCP is the protocol agents use to call outside tools, and a "stdio" MCP server is a local program that Langflow launches and talks to over standard input and output. In versions before 1.9.0, any logged-in user, not only an admin, could save an MCP server whose launch command was handed straight to a shell (CVE-2026-105740, CVSS 9.9). Honeypot operator Previdian has recorded exploitation attempts against it since September 19, rising sharply from October 11.

The 1.9.0 fix was incomplete: a second advisory, CVE-2026-105697 (also CVSS 9.9), shows that other paths to the same shell call stayed open until 1.10.3, and that a default install needs no account at all. If you run Langflow anywhere, the version to be on is 1.10.3 or later. Because the planted command is stored in project settings and runs again every time the server list loads, an instance that was exposed before patching also needs to be checked for a planted entry once it is upgraded.

How it works

From release 1.5.0, Langflow has a settings page and an API, /api/v2/mcp/servers, for adding MCP servers. A Stdio entry has a command, optional args and an env map of environment variables. According to the original advisory (GHSA-7w94-79vh-5mr2, published September 10), POST /api/v2/mcp/servers/{server_name} accepted that body from any authenticated user. The only check was whether Node.js was installed when the command mentioned npx. When Langflow later connected to the server, it built bash -c "exec {command}" from the stored string, so semicolons, &&, backticks and $() all worked as shell syntax.

GET /api/v2/mcp/servers?action_count=true, the request the settings page makes to count each server's tools, connects to every configured server and so runs every stored command. The command runs as the Langflow process user, which holds the provider API keys, database credentials and secrets the workflows use. The env field adds a second route: LD_PRELOAD loads an attacker's library into the launched program, and a changed PATH swaps in a different binary.

The advisory also explains why this makes a good backdoor. The entry reruns whenever the list loads, including when an admin opens MCP settings, and because it is stored in project settings, a review of flows for suspicious custom component code will not find it.

Why 1.9.0 was not enough

Version 1.9.0 (pull request 12290) added validators to the API model: an allowlist of launchers (node, python, python3, npx, uvx, docker), checks on arguments for shell metacharacters, and a block on variables such as LD_PRELOAD, NODE_OPTIONS, PYTHONPATH and BASH_ENV. The code that actually starts the process stayed unchecked and still used bash -c.

Advisory GHSA-w794-rj3p-xv45 (CVE-2026-105697, published September 28) covers what that left. MCP configurations that do not pass through the REST model, such as ones embedded in a flow, passed as tweaks or set in the MCP Tools component, could still run any command in 1.9.0 to 1.10.2. The affected range goes back to 1.1.2, when the older MCP Stdio component already ran commands without validation. The command executes as soon as Langflow tries to connect, even when the interface then reports that the server failed to start. By our reading of the same advisory, a malicious entry stored before an upgrade to 1.9.0 would also still run, since the check sat on the way in and not at launch.

The login step is often missing as well. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login returns a valid token to anyone who asks, so an internet-facing default install can be exploited with no credentials. Version 1.10.3 (pull request 14036) moves the checks into one function that runs at every entry point and again immediately before the process starts, and drops the shell: the command is split with shlex and executed directly.

What attackers are doing

Previdian's public tracker for CVE-2026-105740 shows the first attempt on September 19 at 03:14 UTC, then a scattering of low-volume days until October 10. On October 11 its sensor logged 333 attempts, and daily volume has stayed in the hundreds since. By October 26 the tracker counted 4,757 attempts from 34 addresses in 17 countries. The Hacker News, reporting Previdian's figures on October 15, gave 1,423 attempts from 27 addresses, later updated to 1,706 from 28.

Two limits apply to these numbers. Previdian lists a single sensor, so they measure scanning and exploit attempts against one decoy. They say nothing about how many real servers have been compromised. And as of today neither CVE is in CISA's Known Exploited Vulnerabilities catalog, so tools that rank patches by KEV status will not flag them yet. The Hacker News also describes the payloads and source addresses it saw; we have left those details out because we could not confirm them in a second source.

Sources differ on where the first flaw starts: the NVD entry says every version before 1.9.0, while the GitHub advisory names only 1.8.3. Since CVE-2026-105697 reaches back to 1.1.2, that does not change what to do.

What to do

1. Find every Langflow install. Teams often start it on a laptop or cloud VM without telling IT. Scan for the default port 7860, and on hosts run pip show langflow langflow-base lfx (or docker exec <container> pip show langflow) to read the versions.
2. Upgrade to langflow 1.10.3, langflow-base 0.10.3 and lfx 1.10.3 or later. 1.9.0 to 1.10.2 is still vulnerable. If you install from containers, rebuild with the new image rather than upgrading inside a running one.
3. If you cannot upgrade today, set LANGFLOW_AUTO_LOGIN=false, take the instance off the internet (VPN or an IP allowlist at the reverse proxy) and remove accounts for anyone who does not need one. That closes the no-login route of CVE-2026-105697; any remaining user can still exploit both flaws.
4. Check for a planted entry after upgrading, not before. On an unpatched instance, opening the MCP server settings runs whatever is stored there. On 1.10.3 the launch-time check refuses commands outside the policy. Review every Stdio entry, and every MCP Tools component in your flows, for command, args or env values you did not create: shells, curl, wget, ;, |, $(), or variables such as LD_PRELOAD, BASH_ENV and PATH.
5. Search the logs. In reverse proxy or Langflow access logs, look for POST /api/v2/mcp/servers/ from accounts or addresses you do not expect, GET /api/v1/auto_login from outside your network, and bursts of GET /api/v2/mcp/servers?action_count=true. On the host, look for bash -c or sh processes whose parent is the Langflow Python process (ps -ef --forest shows the tree) and for outbound connections from the Langflow host to addresses it does not normally contact.
6. Rotate secrets if anything looks wrong, or if the instance was reachable and unpatched since September 19. That means LANGFLOW_SECRET_KEY, the superuser password, every model provider key held in global variables or flows, and database credentials the process could read.

On 1.10.3 and later, the allowlist still lets npx and uvx run any package by default. On shared or multi-tenant deployments, set LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES to the exact packages you use, and turn on LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true.

A Langflow account is a shell account

In Langflow, permission to add an MCP server was permission to run commands as the service, and every user had it, or with auto-login every visitor. Treat accounts on agent platforms like SSH access to the host, and put the platform's settings under the same review and change control as the flows, since this flaw hid in settings.

If you want a second pair of eyes on how your agent platforms are exposed, our AI-native systems and attack surface management work covers both the inventory and the configuration review. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Langflow advisory GHSA-7w94-79vh-5mr2, Langflow advisory GHSA-w794-rj3p-xv45, OpenCVE on CVE-2026-105740, OpenCVE on CVE-2026-105697, Previdian tracker, The Hacker News, eSecurityPlanet, SentinelOne, Langflow 1.10.3 release.