Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows.
In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.
In a hypothetical attack scenario, a bad actor can exploit the flaw in the following fashion - Langflow warned.
As of writing, 66 attempts have been observed on October 15, 2026.
The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of authenticated remote code execution impacting versions prior to 1.9.0.
Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override)." The crux of the vulnerability is that Langflow accepts a user-provided command without restricting it to approved executables.
Successful exploitation can result in full server compromise, environment variable injection, facilitate lateral movement, and the deployment of a persistent backdoor, as the malicious MCP server configuration persists and re-executes every time the server list is loaded.
Last month, Langflow also addressed another critical vulnerability ( CVE-2026-105697 , CVSS score: 9.9) that could also result in operating system command injection through MCP stdio server configuration.
Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.
The exploitation efforts ramped up starting October 11, 2026, when 333 attempts were registered.
If immediate patching is not an option, it's advised to set LANGFLOW_AUTO_LOGIN=false, avoid exposing Langflow directly to untrusted networks, and grant Langflow accounts to trusted users.
What happened
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows.
In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.
What changed
In a hypothetical attack scenario, a bad actor can exploit the flaw in the following fashion - Langflow warned.
As of writing, 66 attempts have been observed on October 15, 2026.
Who is affected
The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of authenticated remote code execution impacting versions prior to 1.9.0.
Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override)." The crux of the vulnerability is that Langflow accepts a user-provided command without restricting it to approved executables.
Why it matters
Successful exploitation can result in full server compromise, environment variable injection, facilitate lateral movement, and the deployment of a persistent backdoor, as the malicious MCP server configuration persists and re-executes every time the server list is loaded.
Last month, Langflow also addressed another critical vulnerability ( CVE-2026-105697 , CVSS score: 9.9) that could also result in operating system command injection through MCP stdio server configuration.
Technical details
Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.
The exploitation efforts ramped up starting October 11, 2026, when 333 attempts were registered.
Response
If immediate patching is not an option, it's advised to set LANGFLOW_AUTO_LOGIN=false, avoid exposing Langflow directly to untrusted networks, and grant Langflow accounts to trusted users.
Attribution
The Hacker News: Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.