Langflow vulnerability draws 1,423 recorded exploit attempts
The Langflow vulnerability tracked as CVE-2026-105740 is being actively targeted, with Previdian recording 1,423 exploitation attempts against its honeypot sensors since September 19, 2026. Honeypots are deliberately monitored systems designed to observe malicious activity. The flaw carries a 9.9 score under the Common Vulnerability Scoring System (CVSS) and affects Langflow versions earlier than 1.9.0.
Langflow is an open-source platform for building artificial intelligence applications and automated agent workflows. Its parent company, DataStax, was acquired by IBM in February 2025. The vulnerability allows authenticated remote code execution (RCE), meaning a person who can sign in to Langflow can make its server run operating-system commands. Administrator privileges inside Langflow are not required, so an ordinary authenticated account is sufficient.
The weakness is in the handling of MCP server configurations that use the stdio transport, a method for communicating with a program through its standard input and output. Langflow accepts a command supplied by the user and passes it to a Bash command shell without validation, restrictions on approved programs or isolation from the underlying system. The command runs when the list of configured MCP servers is retrieved. The configuration also accepts arbitrary environment variables, which are settings made available to running software, including changes involving LD_PRELOAD or PATH.
An attacker can sign in as a non-administrator, submit a crafted HTTP POST request to "/api/v2/mcp/servers/{server_name}" and place a malicious instruction in the command field. Langflow stores that instruction without checking it. A subsequent HTTP GET request to "/api/v2/mcp/servers?action_count=true" loads the server list and causes the stored command to execute with the privileges of the Langflow process. A payload could include a reverse shell, which connects the affected server back to an attacker and gives remote command-line access.
Langflow warns that successful exploitation can compromise the server, inject environment variables, support lateral movement into other accessible systems and install a persistent backdoor. Persistence is possible because the malicious MCP server entry remains in the project settings and can run again whenever the server list is loaded. Langflow also notes that these configurations are not normally visible during flow review, unlike custom component code displayed in the flow editor.
Previdian counted activity from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the United States and Vietnam. Attempts increased on October 11, 2026, when 333 were recorded. Another 66 attempts had been observed on October 15 at the time of reporting. The number measures requests reaching Previdian's sensors, not a confirmed count of compromised production systems.
Because CVE-2026-105740 requires authentication, Previdian examined how the observed attackers obtained access. In one sequence, an attacker checked the installed Langflow version and tried the "/api/v1/auto_login" endpoint. Auto-login was disabled on the honeypot, producing a 403 response, but the attacker then successfully signed in with a common username and password. The resulting bearer token, a credential used to authorize later requests, was immediately used to reach the vulnerable MCP server endpoint.
Captured payloads attempted to collect environment variables and sensitive Langflow settings, including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, before transmitting them to 146.70.211[.]112 on port 18764. Other commands used Docker to try to reach the host filesystem and read "/etc/passwd". Previdian also observed basic command-execution checks involving id and whoami, which can reveal the account and privileges under which a process is running.
A large portion of the activity came from 192.255.229[.]92. GreyNoise and Previdian data associates that address with generic brute-force attempts and exploitation attempts involving Flowise vulnerability CVE-2026-69255, as well as Langflow flaws CVE-2026-55255, CVE-2026-9198 and CVE-2026-0768. The targeting of several Langflow vulnerabilities indicates systematic scanning of exposed deployments, but the unidentified actor's ultimate objective remains unclear.
Administrators should upgrade Langflow to version 1.9.0 or a later patched release, disable auto-login, use strong and unique account passwords, and examine authentication records and requests to the MCP server endpoint. If an immediate update is not possible, Langflow advises setting LANGFLOW_AUTO_LOGIN=false, keeping the application away from untrusted networks and limiting accounts to trusted users. Langflow also addressed CVE-2026-105697, another critical 9.9-rated command-injection flaw in MCP stdio server configuration, last month. For businesses seeking support with this kind of systems-security work, AEU-I offers security-first IT, infrastructure and consulting.