Security experts have raised alarms over a serious vulnerability in the Langflow platform, exploited in 1,423 documented attempts, as revealed by cybersecurity firm Previdian. Langflow, an open-source tool that facilitates the development of AI applications, became part of IBM through its acquisition of DataStax in February 2025.
Understanding the Vulnerability
The critical flaw, identified as CVE-2026-105740, boasts a CVSS score of 9.9, indicating its severity. It affects Langflow versions before 1.9.0 and allows authenticated users to execute arbitrary code on servers. This is achieved by adding an MCP server using the ‘stdio’ transport, which processes user commands without validation, leading to potential execution of malicious commands.
The issue arises from Langflow’s failure to restrict user-supplied commands to authorized executables, thereby enabling shell execution. Attackers can exploit this by logging in with non-admin credentials, sending a crafted HTTP POST request to add a malicious MCP server, and triggering execution via a simple HTTP GET request.
Impact and Exploitation Attempts
Successful exploitation grants the attacker complete control over the server, allowing for environment variable injections, lateral movements, and persistent backdoor installations. Unlike visible custom component codes, MCP server configurations remain hidden, posing a continuous threat.
Previdian’s data monitoring has detected 1,423 exploit attempts since September 19, 2026, from 27 different IP addresses across the globe, with a notable increase in activity from October 11, 2026. On October 15, 2026, alone, 66 attempts were recorded.
Defensive Measures and Recommendations
Ryan Dewhurst, CEO of Previdian, highlighted the methods used by attackers to authenticate and exploit the vulnerability, including leveraging common credentials and bearer tokens. Some recorded payloads aimed to access sensitive configurations and execute Docker commands on host systems.
To mitigate these risks, Dewhurst recommends updating to a patched version of Langflow, disabling auto-login, enforcing strong passwords, and scrutinizing authentication logs for suspicious activities. Additionally, Langflow recently addressed another critical flaw (CVE-2026-105697) to prevent OS command injections.
For organizations unable to apply immediate patches, it’s advised to disable auto-login, restrict Langflow exposure to trusted networks, and ensure accounts are allocated to trusted users only, thus reducing potential attack vectors.
