The AI Agent Builder With a 9.9 Flaw: Inside the Langflow Attacks

The tool developers use to build AI agents is being turned against them. Langflow, the open source platform for building and deploying AI powered workflows and agents, carries a critical flaw that lets any logged in user run arbitrary commands on the server behind it. Security researchers tracking the flaw have now confirmed that attackers are exploiting it in the wild: honeypot sensors have logged 1,423 exploitation attempts since mid September, from 27 unique IP addresses spread across 15 countries.

The flaw is tracked as CVE-2026-105740 and carries a CVSS severity score of 9.9 out of 10. It affects Langflow versions before 1.9.0. Langflow became part of IBM's software portfolio when IBM acquired DataStax, Langflow's parent company, in February 2025. Developers and data teams self host it to prototype agents, and those instances often sit next to the crown jewels: API keys, database credentials, and model access tokens stored in project settings.

The flaw: a command field fed straight to the shell

The problem lives in Langflow's support for the Model Context Protocol, the open standard that lets AI assistants call external tools. When a user adds an MCP server using the "stdio" transport, they supply a command for the server to run. Langflow passed that command directly to bash with no validation, no allowlist, and no sandboxing. The moment anyone fetches the MCP server list, the command executes on the host with the privileges of the Langflow process.

The attack takes three steps and needs nothing more than an ordinary account. An attacker logs in as a low privilege user, sends a crafted request adding a malicious MCP server, and then fetches the server list to fire it. The environment variable field allows further tricks, including overrides like LD_PRELOAD and PATH, which deepen an attacker's hold on the machine. The original report was credited to AbdrrahimDahmani, with a later, broader analysis by MosesOX that extended the affected range.

From disclosure to exploitation in weeks

The flaw surfaced in Langflow's GitHub security advisories in September 2026, and the CVE records were published on October 5. Version 1.9.0 added command allowlisting and argument validation to the configuration model, closing the direct path. But the cleanup is not a single version. A second, parallel CVE, CVE-2026-105697, also rated 9.9, describes the same shell wrapping persisting through version 1.10.2. The shell wrapper was only fully removed, with an execution layer security policy applied, in 1.10.3. The safe move is to run the latest release and treat anything older as exposed.

Attackers did not wait for anyone to patch. Previdian, which operates honeypot sensors that pose as vulnerable services, recorded 1,423 exploitation attempts beginning September 19, 2026, from 27 unique IP addresses in 15 countries. The pace accelerated sharply on October 11, with 333 attempts in a single day, and sensors logged 66 attempts on October 15 alone. Ryan Dewhurst, Previdian's founder, described the observed pattern: scanners first check the Langflow version, probe the auto login endpoint, and then log in using common username and password combinations before moving to the vulnerable MCP configuration endpoint.

The captured payloads reveal the motive. Some attempts tried to extract environment variables, including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, and transmit them to an external address. Others attempted Docker commands to reach the host filesystem and read files like /etc/passwd. This is not curiosity. It is credential harvesting aimed at everything the instance connects to.

This is not curiosity. It is credential harvesting aimed at everything the instance connects to.

The backdoor that hides in the settings

There is a quieter danger beyond the initial break in. Langflow stores MCP server configurations in project settings, not in the visible flow editor. A planted configuration never appears when a developer reviews their workflows. It persists and re executes every time the server list is loaded, which makes it a near perfect backdoor. Langflow's own advisory notes that, unlike custom component code that shows up in the flow editor, MCP server configurations are invisible during normal review. Anyone running an affected version should audit stored MCP server configurations for entries they did not create, even after patching.

Why agent platforms keep getting hit

Langflow is part of a rough week for security infrastructure. Attackers are actively exploiting a zero day in Ivanti Connect Secure VPN appliances, a 9.8 rated flaw in Cisco's Secure Email Gateway, and a zero day in Palo Alto's PAN-OS firewall management interface. Each targets the machinery that security teams trust: VPNs, email gateways, firewalls, and now the platforms that build AI agents.

Agent platforms are an attractive target for a simple reason. They are credential rich, frequently deployed in a hurry with default credentials and exposed login pages, and they rarely receive the hardening that mail servers or databases get. When they break, the prize is the developer's environment: cloud keys, repository tokens, customer data, everything the agents were built to touch.

What to do now

Patch first. Langflow closed the direct injection in 1.9.0 and removed the shell wrapper in 1.10.3, so update to the latest release. Change any default or weak credentials on the instance, since guessing common passwords is the first thing observed attackers try. Audit MCP server configurations for entries you did not add. And because a compromised instance may have already handed over its secrets, rotate API keys, database passwords, and tokens stored on or near the Langflow host, even if you patch immediately.

The broader lesson is that the security perimeter now includes the AI tooling developers install on a Friday afternoon. An agent framework with a login page is network infrastructure, and it deserves the same scrutiny as a VPN concentrator or a firewall. The attackers, judging by 1,423 attempts and counting, already treat it that way.