---
title: Hunt: Langflow MCP Stdio server configs used for command execution (CVE-2026-105740) | ctxsec
url: https://ctxsec.com/items/hunt-langflow-mcp-stdio
description: ""
status: "hunt idea"
published: 2026-10-15
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-langflow-mcp-stdio.md)

hunt idea

2026-10-15

### Hunt: Langflow MCP Stdio server configs used for command execution (CVE-2026-105740)

On Langflow servers before 1.9.0 (or before 1.10.3), review web/proxy logs for `POST /api/v2/mcp/servers/<name>` from non-admin users and for repeated `GET /api/v2/mcp/servers?action_count=true`. On the host, look for the Langflow process spawning `bash -c "exec ..."` with unusual children (curl/wget, `/dev/tcp` reverse shells, miners), and for MCP server configs with an `env` block setting `LD_PRELOAD` or `PATH`. Export the stored MCP server list per project and delete anything you didn't create. Also check whether `LANGFLOW_AUTO_LOGIN` is enabled or self-registration is open, since any authenticated account is enough. Rotate credentials in the Langflow environment (LLM keys, database URLs, cloud metadata access) if anything turns up.

Sources: [Langflow GHSA-7w94-79vh-5mr2](https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2) · [Previdian exploitation record](https://previdian.com/CVE-2026-105740)