Observed incident

Attackers target Langflow MCP configuration for code execution

Reported

What happened

Previdian observed attempts to exploit Langflow's authenticated MCP configuration flaw, using server settings to execute commands and probe for exposed credentials.

Parties and reporting

AI tools and systems: Langflow, Model Context Protocol

Outcome

Previdian observed attempts through October 16. Version 1.9.0 fixes the reported settings path; related flow and tweak paths require Langflow/lfx 1.10.3 and langflow-base 0.10.3.

Operating lesson

Keep agent platforms patched, disable automatic login and restrict who can configure executable MCP servers.

Evidence and limits

October 11 is Previdian's recorded attestation date; sensor activity began September 19 and news coverage followed October 15. The initial vulnerability disclosure was September 10. The related September 28 advisory distinguishes the API fix from the wider execution fix. Honeypot attempts do not establish customer breaches.

Sources