Langflow's advisory GHSA-7w94-79vh-5mr2 (critical, CVSS 9.9) says any authenticated user, not just admins, can add an MCP server with the Stdio transport whose command field is passed straight to bash -c "exec {command}" with no validation; the env field also allows LD_PRELOAD/PATH injection. The command runs whenever the MCP server list is fetched (GET /api/v2/mcp/servers?action_count=true), so it re-fires each time anyone opens the MCP settings page and persists out of sight of normal flow review. Fixed in 1.9.0; a related advisory (GHSA-w794-rj3p-xv45) is fixed in 1.10.3, so go to 1.10.3+. Previdian reports exploitation attempts in its honeypots since Sept 19, about 1,500 from 27 IPs as of Oct 15, with daily volume jumping in October. Not on CISA KEV as of catalogVersion 2026.10.14. It is the agent-builder version of a familiar bug: an MCP server config is a command line, and whoever can edit it can run code.