Langflow Under Attack: MCP Servers Become Vector for Authenticated RCE

The Langflow platform, acquired by IBM in February 2025 following the DataStax acquisition, has recorded over 1,400 direct exploit attempts against a critical vulnerability discovered in its MCP server management system. Data collected by Previdian's honeypot between September 19 and October 15, 2026 documents a concrete escalation: from October 11, attempts surged to 333 in a single day, with 66 detections on the day of publication. The case raises a specific architectural problem in the AI-agentic stack: MCP configurations, designed for interoperability between models and tools, escape the visibility of standard review workflows.

The Mechanism: From Configuration Field to Arbitrary Shell

The vulnerability resides in the handling of the Model Context Protocol, the architecture promoted by Anthropic to standardize connections between language models and external tools. In Langflow, creating an MCP server with stdio transport allows the user to specify a command to execute: that field is processed via bash -c 'exec {command}' without any intermediate control.

The severity is twofold. First: the absence of validation, allowlisting, or sandboxing allows injection of arbitrary operating system commands. Second: the env field accepts user-defined environment variables, opening the door to techniques like LD_PRELOAD or PATH override to alter execution behavior. The trigger is synchronous: the command activates not on an explicit call, but on the simple fetch of the MCP server list, an operation the application performs automatically.

"Any authenticated Langflow user (including non-admin accounts) can execute arbitrary OS commands on the server with the privileges of the Langflow process"

Persistence amplifies the risk. Once inserted, the malicious configuration remains stored in project settings and re-executes on every server list load. This characteristic distinguishes the MCP vector from custom components, whose code is visible in the flow editor and subject to natural review in the development workflow.

Honeypot Numbers: Geography and Attacker Tactics

Previdian's honeypot, founded by Ryan Dewhurst, captured 1,423 exploit attempts distributed across 27 unique IP addresses originating from 15 countries: Belgium, China, Germany, Hong Kong, Japan, Nigeria, Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, USA, and Vietnam. The geographic distribution suggests orchestrated activity rather than isolated opportunistic scans.

Analysis of the attack sequence reveals a structured pattern. Operators first verify the Langflow version, attempt the /api/v1/auto_login endpoint — which returns 403 in the honeypot as it is disabled — and proceed with credential stuffing using common credentials. Once authenticated, they use the bearer token to access the vulnerable MCP server configuration endpoint.

Observed commands include attempts to exfiltrate LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD to the address 146.70.211[.]112 on port 18764, along with Docker instructions for host filesystem access and reading /etc/passwd. The address 192.255.229[.]92 is associated with generic brute-force and exploitation of other Langflow vulnerabilities: CVE-2026-55255 (CVSS 8.4), CVE-2026-9198 (CVSS 9.8), CVE-2026-0768 (CVSS 9.8), and Flowise CVE-2026-69255.

According to Strix.ai, the probability of exploitation in the next 30 days estimated by the EPSS model is 0.59%. The source does not specify the calculation method for this figure, which is not independently verifiable without access to the EPSS model.

Why MCP Architecture Amplifies Risk

The Model Context Protocol has emerged as the de facto standard for connecting AI models to external tools — databases, browsers, calculators, execution environments. Its promise is interoperability: a single interface in place of ad hoc integrations for every tool. The trade-off is the introduction of a new configuration surface that escapes established security paradigms.

In Langflow, custom components are first-class entities: code is visible, versioned, reviewable. MCP server configurations reside instead in project settings, outside the visual workflow. This architectural opacity — documented by the source as a structural difference, not an implementation bug — means a malicious modification can persist without passing through traditional visibility checkpoints.

The corporate context adds tension. DataStax, Langflow's parent company, was acquired by IBM in February 2025 in a deal that accelerated the platform's integration into IBM enterprise stacks. The adoption speed of agentic architectures — Langflow, Flowise, and analogues — continues to outpace the maturity of security controls on these configuration surfaces.

Why It Matters

The source does not specify whether the 1,423 attempts represent the entire universe of offensive activity or if alternative datasets exist. It is unknown whether real instances, outside the Previdian honeypot, have been significantly compromised. The dossier also does not clarify which entity published the original advisory: Langflow, a CNA, or an independent researcher.

The brief does not document specific remedial measures beyond updating to version 1.9.0. It does not list default monitoring controls, detection rules for MCP endpoint calls, or vendor-recommended hardening configurations. The source does not specify whether multi-factor authentication mitigates the vulnerability, given that the exploit requires a valid bearer token but does not constrain its acquisition method.

The authenticated nature of the RCE distinguishes CVE-2026-105740 from zero-click vulnerabilities, but does not make it less dangerous: the combination of credential stuffing, configuration persistence, and MCP vector opacity creates a compromise chain achievable with limited resources.

Reading: The Hidden Surface of the AI Stack

The story of CVE-2026-105740 is not that of an isolated bug in an input field. It is an indicator of a category problem: AI orchestration platforms are inheriting architectural patterns — opaque configurations, implicit persistence, automatic execution on fetch — that in traditional infrastructure are already classified as security anti-patterns. The novelty is that these patterns emerge in an ecosystem still in definition, where security standards are not consolidated and attack surfaces are not yet mapped by risk assessment frameworks.

The comparison between custom component visibility and MCP configuration opacity is not a Langflow implementation detail: it is a structural tension of agentic architecture, where configuration flexibility is valued as a feature and traceability is delegated to not-yet-standardized conventions. The 1,423 exploit attempts demonstrate that offensive operators have already identified this asymmetry.

For organizations adopting such platforms, the lesson goes beyond the single patch: security workflow review must extend to configuration layers that do not appear in the main interface but determine the system's executive behavior.

FAQ

Which Langflow versions are vulnerable?

According to The Hacker News and Strix.ai, all versions prior to 1.9.0. Version 1.9.0 contains the fix.

Does the exploit require administrative privileges?

No. The source explicitly documents that any authenticated user, including non-administrative accounts, can trigger the RCE.

Did the 1,423 attempts occur on real systems?

No. The data comes exclusively from the Previdian honeypot. The source does not document verified compromises on production instances.

Sources

• https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html
• https://blog.netmanageit.com/langflows-critical-authenticated-rce-flaw-targeted-in-1-423-honeypot-exploit-attempts/
• https://www.thehackerwire.com/cve-2026-105740-langflow-critical-rce-authenticated-command-injection-via-stdio-transport/
• https://www.guardianmssp.com/2026/10/15/langflows-critical-authenticated-rce-flaw-targeted-in-1423-honeypot-exploit-attempts/
• https://www.strix.ai/cve/CVE-2026-105740
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html

Information is based on cited sources and current as of publication.

Sources