A config field ran as a shell command

Langflow let any authenticated user add an MCP server with the Stdio transport. The command in that config went to bash -c with zero validation, no allowlist, and no sandboxing. It ran the moment the server list was fetched. Loading the MCP settings page was enough.

A POST created the entry. A GET to the server-list endpoint fired when the page loaded, and the stored command ran again each time. The env field accepted arbitrary environment variables, including LD_PRELOAD and a PATH override. A default setting, LANGFLOW_AUTO_LOGIN, is documented as development-only, and with it on an exposed instance handed out an access token without credentials.

The flaw scored 9.9 and carried CWE-78. Two advisories describe it. The first, CVE-2026-105740, published 10 September, was fixed in 1.9.0 with an allowlist on the REST model. The second, CVE-2026-105697, covered the same transport in versions 1.1.2 through 1.10.2, where configs embedded in flows could still reach the shell. Langflow removed the bash wrapper entirely in 1.10.3 and now execs the process directly. Both scored 9.9.

Exploitation is not hypothetical. Honeypot sensors run by Previdian recorded 1,423 attempts since 19 September, from 27 IP addresses in 15 countries, The Hacker News reported. Captured payloads pulled LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and sent them to 146.70.211[.]112:18764. A later count through 16 October put the total at 1,751 attempts from 28 addresses in 16 countries. The counts are sensor observations, not confirmed compromises.

The pattern is familiar. A configuration field treated as data reaches a shell that treats it as code. Here the gate was not weak. It was absent.

Log take: The trigger being an ordinary page load is the detail that matters, because it turns a deliberately added server into a drive-by. (Interpretation; Previdian sensor totals, rising over time.)