Langflow MCP stdio RCE Exploited in the Wild: 1,706 Attempts Steal Secret Keys and Superuser Passwords (CVE-2026-105740)

Langflow versions before 1.9.0

Any authenticated user, including a non-admin, can POST an MCP server with stdio transport to `/api/v2/mcp/servers/{name}` whose command runs unvalidated when the server list is fetched; the `env` field also accepts `LD_PRELOAD` and `PATH` overrides, and the config persists and re-runs on every load. Previdian honeypots logged 1,706 exploitation attempts from 28 IPs since September 19, 2026, with 333 starting October 11 and 316 on October 15. Attackers logged in with common credentials, then exfiltrated `LANGFLOW_SECRET_KEY` and `LANGFLOW_SUPERUSER_PASSWORD` and tried Docker host filesystem access. GreyNoise links one source IP to earlier Langflow and Flowise exploitation. CVSS 9.9. Exploitation figures are single source

User-supplied MCP server commands passed to a shell with no allowlist or sandbox, available to every authenticated role