Langflow: one sensor reports attacks, while two MCP advisories name different fixes

Two records need to stay separate

Cover: AI-generated editorial illustration for P.K. Sharma. Conceptual artwork, not a screenshot or evidence of an observed attack.

The Langflow story has two distinct records. CVE-2026-105740 is the authenticated MCP Stdio issue whose advisory lists 1.8.3 as affected and 1.9.0 as patched. A separate advisory, CVE-2026-105697, lists a broader set of command-launch paths and fixes in 1.10.3. First advisory; Broader advisory.

They should not be collapsed into a single claim that the first CVE is necessarily unpatched in every later release. Equally, a ticket saying only “upgraded to 1.9.0” does not answer whether the separate execution-boundary issue has been addressed.

Version statements in the two vendor advisories, checked 15 October 2026.

Record	Affected as listed	Patched as listed
CVE-2026-105740 / GHSA-7w94-79vh-5mr2	langflow 1.8.3	langflow 1.9.0
CVE-2026-105697 / GHSA-w794-rj3p-xv45	langflow >=1.1.2, <1.10.3; lfx <1.10.3	langflow and lfx 1.10.3
Same broader advisory, separate package	langflow-base >=0.1.2, <0.10.3	langflow-base 0.10.3

Feature image: original typographic editorial cover, not an attack screenshot. Credit: P.K. Sharma; facts: Langflow advisories.

Why validation at one entry point was insufficient

The first advisory describes ordinary authenticated users storing Stdio server commands that run with the Langflow process user’s privileges when the server is connected or listed. A failed tool connection therefore need not mean that no process was started. CVE-2026-105740 description.

The broader record says 1.9.0 added validation to the REST configuration model. Embedded flow and tweak configurations could still reach the launch boundary. It describes 1.10.3 as enforcing shared validation at that boundary and removing the shell wrapper. CVE-2026-105697 fix explanation.

Engineering assessment: a schema check protects the entry points that actually use that schema. If a second route supplies the same sensitive operation, the check needs to hold at the operation itself. The review question is therefore where untrusted configuration becomes authority to create a host process, rather than whether an individual form rejects an input.

What one sensor can and cannot count

In the preserved 15 October snapshot, Previdian displayed 1,628 attempts, 28 source IPs and one sensor for CVE-2026-105740. It gives first observation as 19 September. These counters change; the earlier 1,423 figure in coverage is a different snapshot. Previdian telemetry.

An attempt is not a successful compromise. Repeated traffic can come from one source, and one operator can use several IP addresses. A single observed sensor does not measure the number of exposed Langflow deployments worldwide. The public page does not provide the raw event corpus needed to independently reproduce its count.

The telemetry is attached to CVE-2026-105740. The shared MCP theme does not prove that those same requests exercised CVE-2026-105697. Linking two advisories is useful context; treating the link as proof of one combined campaign would go beyond the evidence.

Keep the evidence unit attached to the statement.

Evidence	Supports	Does not establish
Vendor advisories	Affected paths and stated fixes	Successful exploitation at a named customer
Previdian attempts	Activity seen by that sensor	1,628 breached organisations
28 IPs	Distinct source addresses in the snapshot	28 people, groups or states
A running patched build	Deployment of a fix	Removal of an earlier compromise

A patch ticket needs configuration and package evidence

What would change this assessment? Reconciled vendor version guidance, a reproducible sensor dataset or confirmed incident reporting tied to a specific advisory. Until then, preserve the two CVE identifiers and the measurement limits. No exploit was executed for this briefing.