Langflow MCP stdio Server OS Command Injection (RCE) — CVE-2026-105697

// Langflow MCP stdio command injection — Langflow/uvicorn spawning suspicious children (CVE-2026-105697)
let langflowParents = dynamic(["langflow","uvicorn","gunicorn","python","python3"]);
let suspiciousChildren = dynamic(["sh","bash","zsh","dash","nc","ncat","netcat","curl","wget","powershell","pwsh","cmd","perl","ruby","node"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| extend ParentName = tolower(InitiatingProcessFileName), ChildName = tolower(FileName)
| where ParentName has_any (langflowParents)
| where InitiatingProcessCommandLine has_any ("langflow","lfx","mcp")
| where ChildName has_any (suspiciousChildren)
| where ProcessCommandLine has_any ("-c","-i","/dev/tcp","bash -i","curl ","wget ","base64","python -c")
| project Timestamp, DeviceName, AccountName, ParentName, InitiatingProcessCommandLine, ChildName, ProcessCommandLine, FolderPath
| order by Timestamp desc

index=edr sourcetype="linux:process" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval parent=lower(parent_process_name), child=lower(process_name)
| search (parent="langflow" OR parent="uvicorn" OR parent="gunicorn" OR parent="python" OR parent="python3")
| search (parent_process="*langflow*" OR parent_process="*lfx*" OR parent_process="*mcp*")
| where match(child,"^(sh|bash|zsh|dash|nc|ncat|netcat|curl|wget|powershell|pwsh|cmd|perl|ruby|node)(\.exe)?$")
| regex process="(?i)(-c |-i|/dev/tcp|bash -i|curl |wget |base64|python -c)"
| table _time host user parent parent_process child process
| sort - _time

process where event.type == "start" and
  process.parent.name in ("langflow","uvicorn","gunicorn","python","python3") and
  stringContains(process.parent.command_line, "langflow") and
  process.name in ("sh","bash","zsh","dash","nc","ncat","netcat","curl","wget","powershell","pwsh","cmd","perl","ruby","node") and
  (process.command_line : "*-c *" or process.command_line : "*/dev/tcp*" or process.command_line : "*bash -i*" or process.command_line : "*base64*" or process.command_line : "*python -c*")

SELECT QIDNAME(qid) AS event, "Process Name" AS child, "Parent Process Name" AS parent, "Process CommandLine" AS cmd, sourceip, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOWER("Parent Process Name") IN ('langflow','uvicorn','gunicorn','python','python3') AND LOWER("Parent Process CommandLine") LIKE '%langflow%' AND LOWER("Process Name") IN ('sh','bash','zsh','dash','nc','ncat','netcat','curl','wget','powershell','pwsh','cmd','perl','ruby','node') AND ("Process CommandLine" ILIKE '%-c %' OR "Process CommandLine" ILIKE '%/dev/tcp%' OR "Process CommandLine" ILIKE '%bash -i%' OR "Process CommandLine" ILIKE '%base64%' OR "Process CommandLine" ILIKE '%python -c%') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*edr* OR _sourceCategory=*sysmon* OR _sourceCategory=*linux/process*
| json auto nodrop
| tolowercase(parent_process_name) as parent
| tolowercase(process_name) as child
| where parent in ("langflow","uvicorn","gunicorn","python","python3")
| where parent_command_line matches /(?i)langflow|lfx|mcp/
| where child in ("sh","bash","zsh","dash","nc","ncat","netcat","curl","wget","powershell","pwsh","cmd","perl","ruby","node")
| where process_command_line matches /(?i)(-c |\/dev\/tcp|bash -i|base64|python -c|curl |wget )/
| fields _messagetime, host, user, parent, parent_command_line, child, process_command_line
| sort by _messagetime desc

rule langflow_mcp_command_injection_cve_2026_105697 {
  meta:
    author = "Argus Detection Platform"
    description = "Langflow MCP stdio OS command injection RCE (CVE-2026-105697)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)(langflow|uvicorn|gunicorn|python3?)$`)
    re.regex($e.principal.process.parent_process.command_line, `(?i)langflow|lfx|mcp`)
    re.regex($e.target.process.file.full_path, `(?i)(sh|bash|zsh|dash|nc|ncat|netcat|curl|wget|powershell|pwsh|cmd|perl|ruby|node)(\.exe)?$`)
    re.regex($e.target.process.command_line, `(?i)(-c |/dev/tcp|bash -i|base64|python -c|curl |wget )`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(langflow|uvicorn|gunicorn|python3?)$/i
| ParentCommandLine=/langflow|lfx|mcp/i
| ImageFileName=/\/(sh|bash|zsh|dash|nc|ncat|netcat|curl|wget|powershell|pwsh|cmd|perl|ruby|node)(\.exe)?$/i
| CommandLine=/(-c |\/dev\/tcp|bash -i|base64|python -c|curl |wget )/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine])