CVE-2026-105740 and CVE-2026-105697: Langflow's MCP server settings let any logged-in user run commands on the server
Summary
Langflow, the open-source tool for building AI agents and workflows, has two critical advisories for the same weakness in how it starts MCP servers over the stdio transport. Before the fixes, the command a user typed into an MCP server configuration was run on the Langflow host with no allowlist, inside bash -c. GitHub advisory GHSA-7w94-79vh-5mr2 (CVE-2026-105740, published Sep 10, 2026) covers the Add MCP Server settings path, fixed in Langflow 1.9.0. GHSA-w794-rj3p-xv45 (CVE-2026-105697, published Sep 28, 2026) covers the remaining paths, such as MCP configs embedded in flows, and says the issue is fully fixed in Langflow 1.10.3. Both are rated CVSS 3.1 9.9. With Langflow's default auto-login setting, the advisory says an exposed instance can be attacked without an account. NVD published both CVE records on Oct 5, 2026. The fixes shipped months before disclosure. On Oct 15, 2026, The Hacker News reported that security firm Previdian's honeypots had logged 1,423 attempts to exploit CVE-2026-105740 since Sep 19, 2026, from 27 IP addresses. We have not seen exploitation reports for CVE-2026-105697.
Severity
Timeline
Langflow merges pull request #12290, adding a command allowlist and argument and environment checks to the MCP server API.
Langflow 1.9.0 is released with that change, closing the Add MCP Server path.
Pull request #14036 is merged, applying the same checks where the process is spawned and dropping the bash -c wrapper.
Langflow 1.10.3 is released with the full fix.
Langflow publishes GitHub advisory GHSA-7w94-79vh-5mr2.
Previdian's honeypots record the first exploitation attempts against CVE-2026-105740, according to The Hacker News.
Langflow publishes GitHub advisory GHSA-w794-rj3p-xv45.
NVD publishes CVE-2026-105740 and CVE-2026-105697.
Attempts jump to 333 in a single day, per Previdian's data.
The Hacker News reports Previdian's alert: 1,423 attempts from 27 IP addresses since Sep 19.
How it happened
Langflow can connect agents to MCP servers, and a stdio MCP server is just a local program Langflow starts and talks to. The settings page (Settings, MCP Servers, Add MCP Server) and the POST and PATCH /api/v2/mcp/servers/{server_name} endpoints accepted a command, arguments and environment variables from any authenticated user, not only admins. In versions 1.5.0 through 1.8.x, Langflow ran the stored command through bash -c "exec {command}" without any validation, and it did so as soon as it tried to connect, for example when listing servers or loading tools, even if the UI then said the server failed to start. The env field also allowed variables such as LD_PRELOAD or a changed PATH. Langflow's default LANGFLOW_AUTO_LOGIN=true hands out a token from GET /api/v1/auto_login without credentials, so on an exposed instance with default settings an attacker does not need an account. The advisory notes auto-login is documented as a development-only setting. Langflow 1.9.0 blocked commands outside an allowlist at the API, but MCP configs that reached the spawn code by other routes, such as configs embedded in flows or tweaks and the older MCP Stdio component, were still unchecked. Langflow 1.10.3 enforces the policy at every entry point and right before the process starts, and launches it without a shell. The second advisory says the reporter found several internet-facing Langflow servers that were vulnerable. It also notes that the allowlist still lets npx and uvx run any package by default, so multi-tenant deployments need extra settings. In one attack sequence Previdian described to The Hacker News, the attacker checked the Langflow version, tried /api/v1/auto_login, and when that was disabled signed in with a common username and password, then went straight to the MCP server configuration endpoint. Captured payloads tried to send LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD from the environment to an outside server, read host files through Docker, or ran simple probes such as id and whoami.
How to check your app
- Upgrade Langflow to 1.10.3 or later (langflow-base 0.10.3 and lfx 1.10.3 or later). Version 1.9.0 alone only closes the settings-page path.
- Set LANGFLOW_AUTO_LOGIN=false, keep Langflow off the open internet, and only give accounts to people you trust. Replace any default or common passwords, since the attacks Previdian observed signed in that way.
- Review authentication logs and requests to /api/v2/mcp/servers/ for logins or server entries you do not recognize.
- Look through Settings, MCP Servers and any flows that use the MCP Tools component for stdio commands you did not add. If the instance was reachable while on a vulnerable version, treat the host as possibly compromised and rotate the API keys and credentials stored in Langflow.
- If several people or teams share one instance, also set LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES and turn on LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING and LANGFLOW_MCP_SERVER_DOCKER_HARDENING, as the advisory recommends.
Sources
- GitHub advisory GHSA-7w94-79vh-5mr2: Authenticated RCE via MCP Stdio transport (CVE-2026-105740)
- GitHub advisory GHSA-w794-rj3p-xv45: OS command injection via MCP stdio server configuration (CVE-2026-105697)
- NVD: CVE-2026-105740
- NVD: CVE-2026-105697
- Langflow pull request #12290: prevent MCP command injection via allowlist validation
- Langflow pull request #14036: harden MCP stdio configuration
- Langflow 1.10.3 release on GitHub
- PyPI: langflow release history
- CISA Known Exploited Vulnerabilities catalog
- The Hacker News: Langflow's critical authenticated RCE flaw targeted in 1,423 honeypot exploit attempts (Oct 15, 2026)
- Previdian: sensor-observed exploitation attempts
Corrections and updates
Added Previdian's report, via The Hacker News, of 1,423 honeypot exploitation attempts against CVE-2026-105740 since Sep 19, 2026, plus the attack pattern it observed and two new checks. We previously said no exploitation of these CVEs had been reported.