Langflow RCE Flaw Draws 1,423 Honeypot Exploit Attempts

Attackers are actively going after a critical flaw in Langflow, the open-source platform for building AI applications and agentic workflows, according to an alert from Previdian. The vulnerability, tracked as CVE-2026-105740 with a CVSS score of 9.9, is an authenticated remote code execution bug affecting versions before 1.9.0.

Langflow's own advisory explains that any authenticated user can add an MCP server using the "stdio" transport, and the user-supplied command field is passed straight to bash with no validation, allowlisting or sandboxing. The command runs as soon as the server list is fetched, and the env field permits arbitrary environment variable injection. Because MCP server configurations are stored in project settings rather than the flow editor, they are not visible during normal flow review.

Previdian has logged 1,423 exploitation attempts against its honeypot sensors since September 19, 2026, from 27 unique IP addresses across Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S. and Vietnam. Activity climbed from October 11, 2026, when 333 attempts were recorded, with 66 seen on October 15, 2026.

Previdian founder and CEO Ryan Dewhurst told The Hacker News that in one observed sequence attackers checked the Langflow version, tried /api/v1/auto_login (which returned 403 because it was disabled on the honeypot), then authenticated with a common username and password and used the bearer token to reach the vulnerable endpoint. Captured payloads include attempts to extract LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and send them to 146.70.211[.]112:18764, Docker commands reading /etc/passwd, and simple probes using id and whoami. Much of the activity traces to 192.255.229[.]92, which GreyNoise says has also brute-forced and exploited flaws in Flowise and other Langflow CVEs.

Dewhurst recommended upgrading Langflow, disabling auto-login, enforcing strong unique passwords and reviewing authentication logs and requests to /api/v2/mcp/servers/. Langflow also recently fixed another critical command injection bug, CVE-2026-105697. Where patching is not possible, set LANGFLOW_AUTO_LOGIN=false, keep Langflow off untrusted networks and limit accounts to trusted users.

Source: The Hackers News