Langflow flaw lets any account run server commands
Previdian says honeypots saw 1,423 attempts to exploit CVE-2026-105740 in Langflow, a critical authenticated remote code execution flaw in versions before 1.9.0. The targeting started after the issue was disclosed and has moved from theory to active abuse.
The bug is simple: any authenticated user can save an MCP server entry with a command string, and Langflow passes that string to the shell when someone fetches the server list. Because the command runs from stored configuration with no validation, even a low-privilege account can trigger server-side code execution and leave behind a persistent payload.
For teams running shared Langflow workspaces, the trust boundary sits at the account layer, not the admin layer. If user accounts can define tools or integrations, one compromised login can become server compromise and a foothold for lateral movement, even without admin access.