Vulnerabilities · 3h ago

Langflow flaw lets any account run server commands

Previdian says honeypots saw 1,423 attempts to exploit CVE-2026-105740 in Langflow, a critical authenticated remote code execution flaw in versions before 1.9.0. The targeting started after the issue was disclosed and has moved from theory to active abuse.

The bug is simple: any authenticated user can save an MCP server entry with a command string, and Langflow passes that string to the shell when someone fetches the server list. Because the command runs from stored configuration with no validation, even a low-privilege account can trigger server-side code execution and leave behind a persistent payload.

For teams running shared Langflow workspaces, the trust boundary sits at the account layer, not the admin layer. If user accounts can define tools or integrations, one compromised login can become server compromise and a foothold for lateral movement, even without admin access.

CVE-2026-105740

NVD KEV

CVSS 9.9 CRITICAL: langflow is a tool for building and deploying AI-powered agents and workflows.

CVE-2026-105697

NVD KEV

CVSS 9.9 CRITICAL: langflow is a tool for building and deploying AI-powered agents and workflows.

Timeline

Oct 15 Reported by The Hacker News

Sources

1 source covering this story

The Hacker News Oct 15
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Honeypots logged 1,423 attempts to exploit a critical Langflow flaw that lets authenticated users execute server commands.

Entities

CVE-2026-105740
CVE-2026-105697

Part of the PlainSec briefing for 2026-10-15

Editions

Briefing for 2026-10-15

Vulnerabilities · 3h agoLangflow flaw lets any account run server commandsPrevidian says honeypots saw 1,423 attempts to exploit CVE-2026-105740 in Langflow, a critical authenticated remote code execution flaw in versions before 1.9.0. The targeting started after the issue was disclosed and has moved from theory to active abuse.The bug is simple: any authenticated user can save an MCP server entry with a command string, and Langflow passes that string to the shell when someone fetches the server list. Because the command runs from stored configuration with no validation, even a low-privilege account can trigger server-side code execution and leave behind a persistent payload.For teams running shared Langflow workspaces, the trust boundary sits at the account layer, not the admin layer. If user accounts can define tools or integrations, one compromised login can become server compromise and a foothold for lateral movement, even without admin access.