What happened
CVE-2026-105740 (CVSS 9.9, CWE-78) — prior to 1.9.0 any authenticated Langflow user can achieve RCE by adding an MCP server with 'Stdio' transport: the user-supplied command field is passed directly to bash -c with no allowlisting or sandboxing, executing as the Langflow process when the MCP server list is fetched; env field enables LD_PRELOAD/PATH injection. Previdian honeypots recorded 1,423+ (growing to 1,706) exploitation attempts since Sep 19 2026 from 27-28 IPs across 17 countries, with attempts escalating sharply on Oct 11 and Oct 15 — payloads harvested LANGFLOW_SECRET_KEY/superuser password and /etc/passwd. The attacker pattern seen (check version, hit auto_login, brute-force weak creds, then pivot to the MCP config endpoint) shows the vuln is reachable in practice on default deployments.
Why it matters
This is the flagship AI-agent supply/tooling compromise of the window: a critical, in-the-wild exploited RCE in a mainstream AI agent workflow builder, abused specifically through the MCP integration layer. Compromise gives full server takeover, env-var theft (LLM secrets), lateral movement and persistence that survives flow review because MCP configs hide in project settings. AI teams running any exposed Langflow should treat this as an active-incident-level patching priority.
Attack vector
Authenticated (or via permissive auto-login/weak creds, which attackers demonstrated) non-admin user POSTs a crafted MCP server config to /api/v2/mcp/servers/{name} with a command field; the command is executed via bash -c when the server list is fetched. env field allows LD_PRELOAD/PATH injection. Malicious config persists and re-executes on every server-list load.
Affected systems
Langflow < 1.9.0 (MCP stdio transport MCP server config)
Mitigation
Upgrade to Langflow ≥ 1.9.0 (final hardening in 1.10.3); set LANGFLOW_AUTO_LOGIN=false; do not expose to untrusted networks; monitor POST /api/v2/mcp/servers/ in logs. See GHSA-7w94-79vh-5mr2 and The Hacker News advisory dated 2026-10-15.