Critical Langflow Flaw Under Attack: What Needs Patching?

A critical Langflow vulnerability remains under attack despite the release of security fixes.

Security intelligence firm Previdian recorded exploitation attempts targeting CVE-2026-105740 through October 19, 2026. The remote code execution (RCE) flaw carries a CVSS severity score of 9.9 and allows authenticated users to execute operating system commands on vulnerable servers.

Organizations using Langflow to build AI agents and workflows face potential exposure of application credentials and connected systems. Version 1.9.0 addressed the original vulnerability, but a related command-injection flaw required additional protections in version 1.10.3.

Langflow attacks target MCP command execution

Previdian's exploitation telemetry documents malicious requests targeting the vulnerability. The findings describe observed exploitation attempts, not confirmed compromises of production systems.

Langflow is an open-source AI development platform supporting Model Context Protocol (MCP) integrations. Earlier attacks targeting AI infrastructure have also involved MCP services, credential theft and unauthorized command execution.

According to Langflow's security advisory, insufficient validation allowed authenticated users to supply operating system commands through MCP servers using standard input/output (stdio) transport.

Commands could execute with the privileges of the Langflow service without requiring administrator access. Successful exploitation could expose credentials, sensitive files and connected resources. Malicious configurations could also trigger execution when Langflow subsequently loaded MCP server definitions.

The default LANGFLOW_AUTO_LOGIN=true configuration can issue access tokens without login credentials, increasing exposure on publicly accessible deployments. Separate research identified thousands of internet-accessible AI services, highlighting access-control concerns across self-hosted AI infrastructure.

Patch gaps and Langflow security controls

Langflow 1.9.0 addressed CVE-2026-105740 by introducing validation for the affected MCP configuration interface. However, additional command-execution paths remained vulnerable under a related flaw.

A related security advisory identifies CVE-2026-105697, another critical MCP command-injection vulnerability. The langflow package was affected from version 1.1.2 through 1.10.2, while the langflow-base and lfx packages had separate affected-version ranges.

Langflow 1.10.3 extended validation to additional execution paths and removed an unsafe shell-execution wrapper. Administrators should upgrade to a current supported release containing the fixes and verify all installed dependencies against the advisory's affected-version ranges.

Beyond patching, security risks within AI development toolchains warrant additional controls over package execution and access to connected systems.

Organizations should prioritize these measures:

• Patch and verify deployments: Inventory installations, update affected packages and containers, and confirm running versions.
• Enforce authentication and restrict access: Set LANGFLOW_AUTO_LOGIN=false, limit user privileges and prevent unnecessary public exposure.
• Restrict MCP package execution: Configure LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES to permit only approved packages through the npx and uvx interpreters.
• Harden execution environments: Enable supported MCP interpreter and Docker hardening, restrict custom code execution and enforce least-privilege access.
• Monitor for compromise: Review MCP configurations, access logs, processes and outbound connections. Rotate potentially exposed credentials when compromise is suspected.
• Test incident response plans: Validate detection, containment, credential revocation and recovery procedures for compromised AI development systems.

Patching closes the corrected execution paths but cannot undo an earlier intrusion. Organizations with previously exposed installations should review historical activity and investigate suspicious command execution before considering remediation complete.

Read more: A separate critical RCE flaw in Orkes Conductor also drew thousands of exploitation attempts, exposing similar risks in workflow infrastructure.