Langflow MCP Escape
A Langflow login could run host commands. CVE-2026-105740, rated 9.9, let non-admin users store Model Context Protocol (MCP) stdio commands and environment settings. Listing servers could run persistent commands with Langflow’s privileges.
At 00:34 CEST on 16 October, Previdian showed 1,654 attempts from 28 IPs across 16 countries on one sensor, including 297 on 15 October. These are attempts, not victims.
Two fixes
The first advisory lists 1.8.3 affected, 1.9.0 patched; the CNA’s before-1.9.0 scope concerns stored REST configurations.
The linked CVE-2026-105697 covered flow and tweak configurations still executable in 1.9.0–1.10.2. Fixed floors are langflow 1.10.3, langflow-base 0.10.3 and lfx 1.10.3.
Development-only LANGFLOW_AUTO_LOGIN=true can issue credentialless tokens on exposed instances; otherwise the broader flaw requires authentication. The telemetry does not identify the access route.
Later validation covers API, flow and tweak configurations before process creation, without a shell. Upgrade affected deployments; meanwhile, disable automatic login and limit access to trusted users.
Some custom-code controls need 1.11.1+. Check version-specific package, interpreter and Docker hardening guidance.
Keep the dates attached to their events
The REST repair merged on 27 March 2026, and the broader repair on 14 July. The advisories appeared on 10 and 28 September. The first CVE record followed on 5 October. These are different milestones, not one disclosure date.
Previdian records activity from 19 September to 15 October. These figures do not prove production execution, data theft or one campaign. Do not merge differently scoped dashboard windows.
Work through a deployment review
The NCSC’s incident-management guidance calls for defined responsibilities, proportionate containment and records of decisions, captured evidence and missing data. That provides a response framework, not a Langflow compromise verdict.
In a hypothetical review, maintenance and investigation have separate owners. The first records deployed packages and verified change. The second records the exposure period, evidence examined, gaps and escalation decision. Neither signs for unchecked work.
Preserve relevant settings and records before disruptive changes where safe. If evidence indicates execution, scope the service account’s access and involve incident responders. A clean present-day setting cannot establish what existed earlier. Record that uncertainty instead of turning a successful upgrade into a clean-history finding.
BlackTree reviewed public advisories and development records, not a reader’s deployment. We did not execute either exploit, test the released packages or establish that a particular host was compromised.
