Attackers Target Langflow RCE CVE-2026-105740 as Honeypot Activity Accelerates

Attackers are attempting to exploit a critical command-injection flaw in Langflow, an open-source platform for building AI applications and agentic workflows, according to reporting based on honeypot data from Previdian.

The activity centers on CVE-2026-105740, a CVSS 9.9 vulnerability that allows any authenticated Langflow user—including a non-administrator—to execute operating-system commands with the privileges of the Langflow process. Versions before 1.9.0 are affected; Langflow fixed the issue in 1.9.0.

Previdian recorded 1,423 exploitation attempts across its sensors beginning September 19, 2026, The Hacker News reported. Those attempts came from 27 unique source IP addresses associated with 15 countries. The counts represent activity seen by honeypots, not successful compromises or distinct victims.

Activity increased on October 11, 2026, when the sensors registered 333 attempts. A further 66 attempts had been observed on October 15, 2026, as of the report’s publication.

User-controlled MCP commands reach bash

The Langflow security advisory, published on September 10, 2026, traces CVE-2026-105740 to the configuration of Model Context Protocol servers using the stdio transport.

An authenticated user can submit an arbitrary command value through:

POST /api/v2/mcp/servers/{server_name}

Langflow passes that string to bash -c "exec {command}" without an allowlist, sandbox or meaningful command validation. The available check only looks for a Node.js installation when the command contains npx; it does not restrict executable paths, shell characters or permitted programs.

Execution is triggered when Langflow retrieves the server list through:

GET /api/v2/mcp/servers?action_count=true

The configuration is stored in project settings and can execute again whenever the server list is loaded. Langflow also said these MCP entries are not visible during normal flow review in the same way as custom component code.

The same configuration accepts a user-controlled env dictionary that is merged into the subprocess environment. On Linux, that creates additional attack paths such as modifying PATH or injecting LD_PRELOAD.

Successful exploitation can expose secrets available to the Langflow process, alter application data, establish persistent command execution and potentially support movement into other reachable systems.

Honeypot sequence required valid credentials

According to Previdian CEO Ryan Dewhurst, the observed operators first checked the Langflow version and then requested /api/v1/auto_login. That endpoint returned HTTP 403 on the honeypot because automatic login had been disabled.

The attackers subsequently authenticated with a common username and password, obtained a bearer token and used it to reach the vulnerable MCP configuration endpoint. In this observed sequence, exploitation did not bypass authentication: access was obtained through working credentials after auto-login failed.

Captured payloads attempted to:

• collect environment variables and Langflow settings, including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD;
• transmit data to 146.70.211[.]112 on port 18764;
• run Docker commands intended to reach the host filesystem and read /etc/passwd;
• test command execution with utilities such as id and whoami.

These payloads were collected by honeypots and show attacker intent. They do not establish that production systems were compromised.

Related MCP flaw raises the required patch level

Administrators should also account for CVE-2026-105697, another CVSS 9.9 command-injection issue affecting Langflow’s MCP stdio transport before Langflow 1.10.3.

That vulnerability also lets users place arbitrary commands in an MCP server configuration. Commands execute when Langflow lists servers, loads tools or runs an associated flow. With the default LANGFLOW_AUTO_LOGIN=true setting, an exposed instance can issue a token through GET /api/v1/auto_login without credentials. When automatic login is disabled, an authenticated non-admin user can still exploit the flaw.

CVE-2026-105697 is fixed in:

• Langflow 1.10.3
• langflow-base 0.10.3
• lfx 1.10.3

CVE-2026-105740 itself was fixed in Langflow 1.9.0, but that release does not address the later patch requirement documented for CVE-2026-105697. Operators evaluating MCP exposure should therefore check the installed versions of Langflow and its related packages rather than treating 1.9.0 as a complete resolution for this vulnerability class.

One source IP linked to other Langflow and Flowise probes

GreyNoise data cited by The Hacker News associated 192.255.229[.]92 with a substantial share of the observed activity, including environment-variable extraction and generic brute-force attempts. The same address was also linked to attempts involving several other vulnerabilities:

• CVE-2026-9198, an unauthenticated Langflow RCE chain affecting versions 1.0.0 through 1.10.0 and fixed in 1.10.1;
• CVE-2026-55255, an authenticated authorization flaw before 1.9.1 that permits execution of another user’s flow by supplying its ID;
• CVE-2026-0768, an unauthenticated code-injection flaw in Langflow’s validate endpoint;
• CVE-2026-69255, a Flowise CSVAgent injection vulnerability affecting flowise and flowise-components through 3.1.2.

The linkage shows activity from the same source address, but it does not establish that every attempt belonged to one campaign or operator.

Two of those Langflow flaws are in CISA’s Known Exploited Vulnerabilities catalog. CVE-2026-55255 was added on July 7, 2026, with a federal remediation deadline of July 10, 2026. CVE-2026-9198 was added on August 4, 2026, with a deadline of August 7, 2026.

For both, CISA requires agencies to apply vendor mitigations in accordance with BOD 26-04 and its Forensics Triage Requirements. For cloud services, agencies must follow the applicable BOD 26-04 guidance or discontinue use if mitigations are unavailable.

Flowise systems also need an update

CVE-2026-69255 arises because Flowise’s CSVAgent.ts component inserts attacker-controlled CSV-derived data directly into Python code before executing it with Pyodide. The validation applied to later LLM-generated code does not protect this initial block.

An authenticated attacker can escape the generated string and use Pyodide’s JavaScript bridge to reach Node.js functionality, leading to operating-system command execution as root inside the Flowise container.

NVD assigns the issue CVSS 8.8. The Flowise GitHub advisory, published July 29, 2026, presents different severity calculations: CVSS 9.9 under version 3.1 and 9.2 under version 4.0. The advisory’s v4 vector indicates no privileges while its technical description refers to an authenticated attacker.

Both affected npm packages are fixed in version 3.1.3. As its “Best” remediation option, the advisory recommends passing base64 data to Pyodide through pyodide.globals.set('base64_string', base64String) instead of using string interpolation. Its other options are validating the base64 character set or escaping special characters before interpolation.

What Langflow administrators should do

Langflow operators should inventory exposed instances and upgrade to versions that address all applicable flaws. At minimum, the documented fixes are:

Where immediate patching is not possible, administrators should set LANGFLOW_AUTO_LOGIN=false, avoid exposing Langflow directly to untrusted networks and restrict accounts to trusted users with strong, unique passwords.

Defenders should review authentication records, requests involving /api/v1/auto_login, and activity against /api/v2/mcp/servers/. Stored MCP server configurations also warrant inspection because a malicious entry can execute repeatedly when Langflow loads the server list. Connections to 146.70.211[.]112:18764 and activity associated with 192.255.229[.]92 may provide useful investigative leads, but should be evaluated in context rather than treated alone as proof of compromise.