Attackers are attempting to exploit a critical command-injection vulnerability affecting every Langflow release before 1.9.0, according to security firm Previdian. The flaw, tracked as CVE-2026-105740, allows any authenticated Langflow user to execute operating-system commands on the underlying server.
Previdian’s honeypot sensors recorded the first attempt on September 19, more than two weeks before the CVE was published on October 5, according to reporting by SecurityWeek. The firm counted more than 1,800 attempts originating from 28 IP addresses across 16 countries. Those figures cover Previdian’s sensors rather than global exploitation, and an attempt does not by itself establish that a system was compromised.
Administrators should upgrade Langflow to version 1.9.0 or later.
Unvalidated MCP configuration reaches bash
Langflow is used to build and deploy AI-powered agents and workflows. The vulnerability sits in the handling of Model Context Protocol server configurations.
An authenticated user can add an MCP server using the Stdio transport and supply a command. On vulnerable releases, Langflow inserts that value directly into:
bash -c "exec {command}"
There is no validation, allowlist or sandbox between the user-controlled field and the shell. The command runs when the server list is fetched, producing remote code execution on the Langflow host.
The same configuration also accepts arbitrary environment variables. An attacker could manipulate values such as LD_PRELOAD or override PATH, creating additional ways to influence which code the server loads or executes.
The vulnerability is classified as CWE-78, or OS command injection. It carries a CVSS v3 score of 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This reflects a network-reachable attack requiring low privileges and no user interaction, with potentially high impact on confidentiality, integrity and availability.
A valid account is the key prerequisite
CVE-2026-105740 is not described as an unauthenticated flaw. Exploitation requires a valid Langflow account, although the NVD record does not restrict the issue to a particular role.
That condition makes account control part of the defensive picture but does not substantially reduce the need to patch. A low-privileged user who can add the relevant MCP server configuration may cross the application boundary and execute commands on the host.
Organizations running Langflow should identify installations below 1.9.0 and upgrade them. When investigating possible exposure, defenders can prioritize unexpected Stdio MCP server configurations and activity involving valid accounts capable of creating them, while treating Previdian’s reported traffic as evidence of exploitation attempts rather than proof that every targeted instance was successfully breached.
