Search — “CVE-2026-105697”

A critical authenticated RCE in Langflow <1.9.0 lets any authenticated user add an MCP server with 'Stdio' transport whose command field is passed to bash -c "exec {command}" with no validation; the command runs when the server list is fetched. Previdian honeypots logged 1,423+ exploit attempts since Sep 19, 2026 from 27+ IPs, with attempts ramping from Oct 11. Attackers brute-force/auto-login to authenticate, then POST to /api/v2/mcp/servers/ to plant reverse shells and extract LANGFLOW_SECRET_KEY/LANGFLOW_SUPERUSER_PASSWORD. Hunt auth logs and requests to /api/v2/mcp/servers/.