Attackers are going after a critical Langflow flaw that turns the AI agent builder’s MCP server settings into a way to run commands on the host. The prize is not just the server: it is the secret keys, model provider API keys and data connections that these platforms hold by design.
What happened
On 15 October 2026 the threat intelligence firm Previdian warned that its honeypot had caught repeated attempts to exploit CVE-2026-105740, a critical flaw in Langflow, the open-source low-code platform used to assemble AI applications and agent workflows. The Hacker News reported the alert the same day.
The bug carries a CVSS score of 9.9. Langflow’s own GitHub security advisory, published on 10 September, explains that any logged-in user, not only an administrator, can get the server to run operating system commands by registering a Model Context Protocol (MCP) server that uses the local “stdio” transport. The command supplied in that configuration was handed to a shell without any validation, allowlist or sandbox. The issue is fixed in Langflow 1.9.0.
According to figures Previdian gave The Hacker News, more than 1,700 attempts had been recorded from 28 IP addresses by 15 October, with a marked rise from 11 October. Previdian’s public page lists attackers in 16 countries and shows activity continuing into 16 October. It is worth being clear about what this is: telemetry from one vendor’s sensor network. It proves the exploit is being tried against exposed systems, not how many real instances have fallen.
At the time of writing, CVE-2026-105740 is not in CISA’s Known Exploited Vulnerabilities catalogue. Six other Langflow flaws are, all added since May 2025, and CISA records one of them, CVE-2025-3248, as used in ransomware campaigns.
The technical picture
MCP is the open standard that lets AI models call external tools and data sources. A “stdio” MCP server is simply a local program that the host launches and talks to over standard input and output. That design is convenient on a developer’s laptop. On a shared, network-facing server, it means the field where a user names the program to start is effectively a command line.
Langflow’s advisory adds two details that matter to defenders. First, the configuration also accepts environment variables, which widens what an attacker can influence on the host. Second, the malicious entry persists in project settings and runs again whenever the server list is loaded, so it behaves as a backdoor that survives restarts. The advisory notes that these MCP settings are not visible to someone reviewing a flow in the editor, which makes them easy to miss during a normal check.
The authentication requirement is weaker protection than it sounds. Previdian’s founder, Ryan Dewhurst, told The Hacker News that in one observed sequence the attacker checked the version, tried the auto-login feature, and then simply signed in with a common username and password. From there, the payloads Previdian describes were aimed at reading environment variables, including LANGFLOW_SECRET_KEY and the superuser password, and sending them to an external host. Others tried to reach the underlying host through Docker or ran basic reconnaissance commands.
One address behind much of the traffic has also been seen by Previdian and GreyNoise trying brute-force logins and other Langflow and Flowise flaws, which points to a methodical, so far unattributed campaign against exposed AI workflow tools.
Why it matters for UK organisations
Agent builders such as Langflow often arrive in UK organisations through innovation teams, data scientists or individual developers rather than central IT. They are commonly stood up on a cloud or container host, given a public address so colleagues can reach them, and left on default or shared accounts. That is exactly the profile this campaign looks for.
What makes these platforms attractive is what they are wired into. An agent workflow typically holds API keys for one or more model providers, credentials for vector databases, connectors to SharePoint, CRM or ticketing systems, and sometimes cloud service accounts. Compromise of the host can mean stolen LLM spend, access to the documents fed into retrieval pipelines, and a foothold for lateral movement into the wider estate. Where those documents contain personal data, a breach engages UK GDPR and could trigger a report to the ICO within 72 hours.
There is also a governance angle. AI infrastructure needs the same asset management, patching and hardening as any other internet-facing service, yet many organisations simply do not know they are running an agent builder at all, let alone which version.
Expert view
In my experience, the AI tooling we find during internal tests is often the softest target on the network. It is deployed fast, with default settings, and rarely sits in the vulnerability management programme. This flaw shows why: the feature works as intended for a lone developer and becomes dangerous only once the tool is shared.
The broader lesson is about MCP itself. Any product that lets a user define a local MCP server is, in effect, offering a command execution feature, and should be threat-modelled as one. I would expect more vulnerabilities of this shape across agent platforms over the coming months, and I would treat “authenticated only” with scepticism whenever default credentials or open sign-up are in play. When we test these systems, the question is rarely whether a regular user can reach the dangerous setting. It is how quickly an outsider can become a regular user.
Keep the numbers in proportion, though. A few hundred attempts on peak days against one vendor’s sensors shows real interest, not mass exploitation. The risk sits with instances that are both internet-facing and weakly authenticated.
What to do now
- Find every instance. Search cloud accounts, container registries and asset inventories for Langflow, and ask development and data teams directly. You cannot patch what you do not know about.
- Upgrade. Move to Langflow 1.10.3 or later, which covers both CVE-2026-105740 (fixed in 1.9.0) and the related command injection flaw CVE-2026-105697. This maps to the Cyber Essentials security update management control.
- Take it off the internet. Place Langflow behind a VPN, identity-aware proxy or private network. Cyber Essentials firewall controls apply here.
- Fix authentication. Disable auto-login, remove default and shared accounts, enforce strong unique passwords and MFA at the access layer, and restrict accounts to people who need them (user access control).
- Assume exposure if in doubt. If an instance was public and unpatched, review authentication logs and MCP server configurations for unfamiliar entries, then rotate LANGFLOW_SECRET_KEY, admin passwords and every model provider and data connector credential the platform holds.
- Contain the host. Run the platform as a non-root user, avoid mounting the Docker socket, and restrict outbound network access so stolen secrets cannot easily leave (secure configuration).
- Bring AI tools into governance. Add agent builders to your asset register, vulnerability scanning and supplier review processes.
Bottom line
CVE-2026-105740 is a reminder that AI agent platforms are servers first and clever software second. One vendor’s sensor shows attackers actively probing for it, and the credentials these tools hold make them well worth stealing. Patch, pull them off the public internet and rotate secrets on anything that was exposed.
