Search — “CVE-2026-105740”

A critical authenticated RCE in Langflow <1.9.0 lets any authenticated user add an MCP server with 'Stdio' transport whose command field is passed to bash -c "exec {command}" with no validation; the command runs when the server list is fetched. Previdian honeypots logged 1,423+ exploit attempts since Sep 19, 2026 from 27+ IPs, with attempts ramping from Oct 11. Attackers brute-force/auto-login to authenticate, then POST to /api/v2/mcp/servers/ to plant reverse shells and extract LANGFLOW_SECRET_KEY/LANGFLOW_SUPERUSER_PASSWORD. Hunt auth logs and requests to /api/v2/mcp/servers/.

A brief item reports that a critical RCE in Langflow (CVE-2026-105740), caused by unsandboxed MCP server commands, was reportedly exploited from September 19, more than two weeks before the CVE was published, with over 1,800 attempts logged. The claim is unconfirmed and rests on a single roundup, and the cited SecurityWeek source does not print any Langflow details. No behaviors, commands, or indicators are available to hunt on, so defenders should verify the claim with the vendor advisory before acting.