Brief · Builders

Your AI workflow builder's settings page is a shell

By alkizz · Oct 19, 2026

Langflow lets a logged-in user add an MCP "stdio" server. The command field goes straight into bash -c, and Langflow runs it every time the server list loads. That's CVE-2026-105740, CVSS 9.9, and people are using it. Previdian's honeypot sensors have logged attempts since Sep 19, more than 2,100 of them between Oct 12 and Oct 19 (UTC), and were still seeing them on Oct 19.

"Logged-in" is doing less work than it sounds. With LANGFLOW_AUTO_LOGIN=true, which is the application default (the official Docker images set it to false), Langflow signs everyone in as the superuser, so an exposed instance may not need an account at all. The Hacker News also reports an attacker getting in with a common password after auto-login returned 403.

The patch story has a wrinkle. Version 1.9.0 fixes 105740, but a sibling flaw in the same code path, CVE-2026-105697, isn't fully fixed until 1.10.3. Go to 1.10.3 or later. 105740 wasn't in CISA's KEV catalog as of the Oct 16 feed, which tells you about paperwork, not about attackers.

Sidebar: Archon's control API

CVE-2026-111322: by default, Archon binds its /api/* control API to 0.0.0.0:3090 with no auth. Anyone who can reach the port can start conversations, message the coding agent, run workflows, and approve paused actions. And the coding agent behind it runs with its permission checks turned off (permissionMode: 'bypassPermissions').

On impact, the sources disagree. The CVE text says attackers can "execute commands on the host as the Archon user." The finder's write-up says runtime validation wasn't performed and "This is not remote code execution on the host"; it depends on the workflows you've configured. As of Oct 19 there's no fixed release. v0.12.0 and v0.12.1 still default to 0.0.0.0. Bind it to localhost or turn on auth.

Also in the MCP pile this week: an Unla OAuth server that never authenticates the resource owner (CVE-2026-108865, no fix yet), a mac-shell-mcp allowlist bypass (CVE-2026-108953) fixed only in the scoped @the_cfdude/mac-shell-mcp 2.0.0 (the unscoped mac-shell-mcp package is still on 1.0.4), and a FastMCP client bug where a malicious server's schema title runs as Python (fixed in 3.4.8 and 4.0.11).

My take: we keep building "add a tool" buttons that are really "add a command" buttons, then acting surprised when someone presses them.

What to do:

• Langflow:
  • Upgrade to 1.10.3 or later.
  • Set LANGFLOW_AUTO_LOGIN=false, kill default and weak passwords, and keep it off the open internet.
• Archon:
  • Set HOST=127.0.0.1 or firewall port 3090.
  • Or enable web auth: Postgres DATABASE_URL plus a 32+ character BETTER_AUTH_SECRET.
• Check (incident response):
  • Export every Langflow MCP server config and look for servers you didn't add. They persist and re-run on every list load.
  • Pull logs for POST/PATCH /api/v2/mcp/servers/*, and check egress to 146.70.211[.]112:18764.
  • For Archon, look for message, workflow-run, and approve calls you didn't make.
• Preserve: save logs, and the Archon database, before you upgrade or rebuild.
• Rotate: LANGFLOW_SECRET_KEY, the superuser password, and every secret the process or agent could reach.

Sources

• Langflow advisory GHSA-7w94-79vh-5mr2
• Langflow advisory GHSA-w794-rj3p-xv45 (CVE-2026-105697, fixed in 1.10.3)
• The Hacker News: Langflow's critical authenticated RCE (Oct 15, 2026)
• Previdian: CVE-2026-105740 exploitation signals
• Langflow docs: API keys and authentication (AUTO_LOGIN)
• VulnCheck: Archon missing authentication via API control API
• CVE-2026-111322 (GitHub Advisory Database, GHSA-3q7p-hhhj-qh4p)
• Finder's write-up (HackMD)
• Archon on GitHub
• Archon source: bypassPermissions (v0.12.1)
• VulnCheck: Unla OAuth2 authentication bypass (CVE-2026-108865)
• VulnCheck: mac-shell-mcp command injection (CVE-2026-108953)
• FastMCP advisory GHSA-gpgx-58w2-xwwf

← All briefs