Threat
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
First reported thehackernews.com
Page published · Page updated
Earliest dated coverage: 15 Oct 2026 · First observed: 15 Oct 2026 · Latest dated coverage: 15 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
CVE-2026-105740 lets any authenticated user turn Langflow's MCP integration into server-side code execution, and with active in-the-wild exploitation defenders running AI agent platforms must upgrade to 1.9.0 immediately.
CVE-2026-105740 (CVSS 9.9), a critical authenticated remote code execution flaw in Langflow, an open-source platform for building AI applications and agentic workflows, is being actively exploited, with Previdian observing 1,423 honeypot exploit attempts. Any authenticated user can achieve RCE by adding an MCP server with the 'stdio' transport, because the user-supplied command field is passed directly to bash -c "exec {command}"; versions prior to 1.9.0 are affected.
Summary
Threat actors are actively exploiting CVE-2026-105740 (CVSS 9.9), a critical authenticated remote code execution flaw in the open-source AI application platform Langflow affecting versions prior to 1.9.0, according to an alert from Previdian.[1]
The flaw lets any authenticated user, including non-admin accounts, achieve code execution by adding an MCP server with the 'stdio' transport, whose user-supplied command field is passed directly to bash with no validation or sandboxing. Previdian recorded 1,423 exploitation attempts against its honeypots since September 19, 2026, from 27 unique IPs, with activity sharply increasing from October 11, 2026.[1]
No named threat actor has been attributed; the observed activity appears opportunistic, with attackers authenticating via common credentials and disabled auto-login endpoints before reaching the vulnerable MCP server configuration endpoint.[1]
Attack chain
- Authentication: Attackers checked the Langflow version, attempted /api/v1/auto_login (which returned 403 in the honeypot where it was disabled), and then authenticated using a common username and password, obtaining a bearer token.[1]
- Malicious MCP server creation: The attacker sends a crafted HTTP POST request to /api/v2/mcp/servers/{server_name} with a command field containing a malicious payload such as a reverse shell; the server stores the attacker-supplied command without validation.[1]
- Trigger execution: Fetching the MCP server list via an HTTP GET to /api/v2/mcp/servers?action_count=true causes the stored command to execute via bash -c "exec {command}", achieving OS command execution with the privileges of the Langflow process.[1]
- Post-exploitation: Observed payloads attempted to extract environment variables and sensitive configuration (LANGFLOW_SECRET_KEY, LANGFLOW_SUPERUSER_PASSWORD) and exfiltrate them, ran Docker commands to read the host filesystem and /etc/passwd, and ran reconnaissance probes such as id and whoami. The malicious MCP config persists and re-executes, enabling a persistent backdoor.[1]
Disclosure timeline
| Date | Event |
|---|---|
| February 2025 | DataStax, the parent company of Langflow, was acquired by IBM.[1] |
| September 2026 | Langflow published a security advisory (GHSA-7w94-79vh-5mr2) for CVE-2026-105740, and also addressed CVE-2026-105697.[1] |
| September 19, 2026 | Previdian began recording exploitation attempts against its honeypot sensors.[1] |
| October 11, 2026 | Exploitation efforts ramped up with 333 attempts registered in one day.[1] |
| October 15, 2026 | The Hacker News published the report; 66 attempts had been observed that day, totaling 1,423 recorded attempts.[1] |
How it works
The vulnerability stems from Langflow accepting a user-provided command when configuring an MCP server with the 'stdio' transport. The command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing.[1]
The command executes immediately when the MCP server list is fetched (via GET /api/v2/mcp/servers?action_count=true). The env field additionally allows arbitrary environment variable injection such as LD_PRELOAD or PATH override. Because MCP server configs are stored in project settings rather than being visible in the flow editor, the malicious configuration is not visible during normal flow review and re-executes every time the server list is loaded, enabling persistence.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Langflow | Versions prior to 1.9.0 (CVE-2026-105740) | Patched in 1.9.0; upgrade to a patched version recommended.[1] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| ip | 146.70.211.112 | Exfiltration destination (port 18764) for extracted environment variables and sensitive Langflow configurations including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD.[1] |
| ip | 192.255.229.92 | Source of a significant chunk of the exploitation activity attempting to extract environment variables; per GreyNoise has also engaged in brute-force attacks and exploited other Flowise/Langflow flaws.[1] |
| cve | CVE-2026-105740 | Critical authenticated RCE in Langflow being exploited in the wild via MCP stdio server configuration.[1] |
| cve | CVE-2026-105697 | Related critical OS command injection flaw in Langflow via MCP stdio server configuration, addressed the same period.[1] |
| file-path | /api/v2/mcp/servers/ | Endpoint used to create and trigger malicious MCP server configurations; requests to it should be reviewed for suspicious activity.[1] |
Key takeaways
- An authentication requirement provides little protection when attackers can obtain valid credentials via common passwords and disabled or misconfigured auto-login endpoints.[1]
- Malicious MCP server configurations persist in project settings and are not visible during normal flow review, making this an effective and stealthy persistence mechanism.[1]
- The flaw is part of a broader pattern of actively exploited Langflow and Flowise RCE vulnerabilities, underscoring the risk of exposing AI/agentic workflow platforms to untrusted networks.[1]
Defensive actions
- Upgrade Langflow to a patched version (1.9.0 or later).: Versions prior to 1.9.0 are vulnerable to CVE-2026-105740 authenticated RCE.[1]
- Disable auto-login by setting LANGFLOW_AUTO_LOGIN=false.: Attackers attempted /api/v1/auto_login as part of authentication; disabling it removes an easy authentication path when immediate patching is not possible.[1]
- Enforce strong, unique passwords and grant Langflow accounts only to trusted users.: Observed attackers authenticated using common username/password combinations before exploiting the flaw.[1]
- Avoid exposing Langflow directly to untrusted networks and review authentication logs and requests to /api/v2/mcp/servers/ for suspicious activity.: Reduces attack surface and detects attempts to create or trigger malicious MCP server configurations.[1]