Attackers target critical Langflow RCE flaw in more than 1,400 honeypot exploit attempts

Attackers are actively probing a critical remote code execution vulnerability in Langflow, the open-source platform for building AI applications and agentic workflows, according to The Hacker News. Citing an alert from security firm Previdian, the publication reported on October 15 that honeypots had logged 1,423 attempts to exploit CVE-2026-105740 since September 19, 2026. The flaw carries a CVSS score of 9.9 and was fixed in Langflow 1.9.0 last month, making unpatched internet-facing instances an urgent concern.

What happened

According to The Hacker News, Previdian observed exploitation attempts from 27 unique IP addresses located in countries including the U.S., China, Germany, Russia, Singapore, South Korea and Vietnam. Activity ramped up from October 11, when 333 attempts were recorded in a single day, and 66 attempts had been seen on October 15 at the time of writing.

Because the vulnerability requires authentication, Previdian looked at how attackers were logging in. The report says they first checked the Langflow version, tried the /api/v1/auto_login endpoint, and then signed in using a common username and password before using the resulting bearer token against the vulnerable endpoint. "We've investigated how attackers are authenticating, as this vulnerability requires authentication," Previdian founder and CEO Ryan Dewhurst said.

Technical details

The Langflow advisory (GHSA-7w94-79vh-5mr2) states that any authenticated user can achieve remote code execution on the server. According to the report, Langflow passed a user-supplied command value from MCP server configuration to a shell without validation, allowlisting or sandboxing, and the command runs when the MCP server list is loaded. An env field also allowed arbitrary environment variables to be injected.

The Hacker News noted that malicious MCP configurations are stored in project settings and are not visible during normal flow review, which means a planted command can act as a hidden, persistent backdoor that re-runs every time the server list loads.

Payloads seen by Previdian attempted to extract environment variables such as LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and send them to 146.70.211[.]112, ran Docker commands to read host files, and executed simple probes such as id and whoami. One IP address, 192.255.229[.]92, accounted for a large share of the activity and has been linked by GreyNoise and Previdian to brute-force attacks and exploitation of other Langflow and Flowise flaws.

A second Langflow issue, CVE-2026-105697 (CVSS 9.9), which allows OS command injection through MCP stdio server configuration, was also patched last month, the report added.

Who is affected

Organizations running Langflow versions earlier than 1.9.0, particularly instances reachable from the internet or protected by weak or default credentials, are at risk. Langflow's parent company DataStax was acquired by IBM in 2025.

What to do

The recommended steps are to upgrade to Langflow 1.9.0 or later, set LANGFLOW_AUTO_LOGIN=false, enforce strong and unique passwords, and limit accounts to trusted users. Administrators should review authentication logs and requests to /api/v2/mcp/servers/, inspect stored MCP server configurations for unexpected commands, avoid exposing Langflow directly to untrusted networks, and rotate secrets on any instance that may have been compromised.