Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

Honeypot Sensors Catch Real-World Attacks on Langflow's Authenticated RCE Flaw

New telemetry from cybersecurity monitoring firm Previdian shows threat actors are actively probing a critical remote code execution flaw in Langflow, the open-source platform used to build AI applications and agentic workflows. Previdian's honeypot sensors recorded 1,423 exploitation attempts against the vulnerability since September 19, 2026, with a sharp spike of 333-plus attempts between October 11 and 15, according to an alert cited by The Hacker News.

The targeted flaw is tracked as CVE-2026-105740, a maximum-severity, CVSS 9.9 authenticated RCE in Langflow's handling of Model Context Protocol (MCP) server configurations. This is a distinct, newer development from the unauthenticated CVE-2026-33017 RCE Labs covered in March 2026 (weaponized within 20 hours of disclosure and later added to CISA's KEV catalog) — this story is about fresh honeypot-captured attack telemetry against a different, authenticated flaw disclosed in October 2026, confirming attackers have moved from proof-of-concept to sustained, real-world scanning and exploitation.

How the Flaw Works

Langflow lets users register external MCP servers for use inside AI workflows. For servers configured with the "Stdio" transport, Langflow spawns the server as a local subprocess using a user-supplied command field, which prior to version 1.9.0 was passed directly into a bash -c "exec {command}" call with no validation or sandboxing. An attacker who holds any valid Langflow account — not necessarily an administrator — can embed shell metacharacters in that field to run arbitrary commands with the privileges of the Langflow process. An unsanitized env field compounds the risk, allowing variable injection (for example LD_PRELOAD or PATH overrides) to hijack execution further. Labs covered the technical root cause of this specific CVE in detail in a dedicated security advisory.

The Attack Chain Observed in the Wild

Previdian's sensors captured attackers following a consistent sequence:

1. Reconnaissance — Version enumeration via Langflow API checks to confirm an exploitable, pre-1.9.0 instance
2. Credential access — Authentication attempts using common default and weak username/password combinations, since the flaw requires a valid account to reach the vulnerable endpoint
3. Exploitation — A crafted POST request to /api/v2/mcp/servers/{server_name} containing a malicious command payload, followed by a GET request to /api/v2/mcp/servers?action_count=true to trigger execution
4. Post-exploitation — Command execution probes using id and whoami to confirm code execution, environment-variable extraction targeting LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, and Docker commands attempting to break out to the host filesystem
5. Exfiltration — Observed callback traffic to an external IP, 146.70.211[.]112:18764

What the Telemetry Reveals

The breadth of the campaign is notable: Previdian attributes the 1,423 attempts to 27 unique IP addresses spanning 15 countries, including Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, the Seychelles, Singapore, South Korea, Taiwan, Tanzania, the United States, and Vietnam. That geographic spread, combined with the automated version-checking and credential-stuffing behavior, points to opportunistic, broadly distributed scanning rather than a single targeted actor — consistent with how internet-exposed AI infrastructure gets swept up in mass exploitation campaigns shortly after public disclosure of a high-severity flaw.

Impact Assessment

Recommendations

For Langflow Administrators

• Upgrade immediately to Langflow 1.9.0 or later to close CVE-2026-105740; upgrade to 1.10.3 or later to also close the related MCP stdio execution regression tracked as CVE-2026-105697
• Set LANGFLOW_AUTO_LOGIN=false to disable automatic, unauthenticated session creation
• Avoid exposing Langflow instances to untrusted or public networks; restrict access to a VPN or trusted internal segment
• Audit all existing MCP server configurations for unexpected "Stdio" transport entries or suspicious command/env values

For Security Teams

• Monitor authentication logs for credential-stuffing patterns (rapid attempts against common username/password pairs) against Langflow login endpoints
• Watch for requests to /api/v2/mcp/servers/ containing shell metacharacters (;, |, &&, backticks, $()) in the command field
• Alert on outbound connections from Langflow hosts to 146.70.211[.]112 or similar unexplained external callback destinations
• Treat any Langflow instance that was internet-accessible on a pre-1.9.0 build as potentially compromised and rotate all associated secrets

For All Users of Self-Hosted AI Platforms

• Restrict account provisioning on agentic AI tools to trusted users only — this flaw shows a single low-privilege account is enough to compromise the whole host
• Enforce unique, strong passwords and, where supported, multi-factor authentication on AI workflow platforms
• Treat AI orchestration tools like Langflow as high-value infrastructure that requires the same network segmentation and monitoring as production application servers

Why AI Agentic Platforms Keep Getting Targeted

Langflow is the latest in a growing list of AI agent and workflow platforms drawing sustained attacker interest in 2026, following prior Labs coverage of separate Langflow RCE issues exploited for ransomware deployment, cryptomining, and credential theft. These platforms are attractive targets because a single compromised instance can expose LLM provider API keys, database credentials, and cloud secrets all at once — plus, because they often orchestrate autonomous actions, a compromise can be chained into further automated attacks rather than requiring manual follow-up. The sustained, geographically distributed probing documented by Previdian confirms that once a flaw like CVE-2026-105740 becomes public, internet-exposed instances are swept into mass scanning campaigns almost immediately — and stay targeted for weeks afterward.

Key Takeaways

1. CVE-2026-105740, a CVSS 9.9 authenticated RCE in Langflow's MCP stdio handling, has drawn 1,423 honeypot-logged exploitation attempts since September 19, 2026
2. Attacks originate from 27 unique IPs across 15 countries, with a spike of 333+ attempts between October 11-15, 2026
3. Observed TTPs include credential stuffing, version fingerprinting, environment-variable secret theft, Docker host-breakout attempts, and outbound exfiltration to 146.70.211[.]112
4. Any authenticated Langflow account — not just admin accounts — is enough to trigger the exploit chain
5. Upgrading to 1.10.3 or later is required to fully close this issue and a related regression (CVE-2026-105697)
6. This is distinct, newer honeypot telemetry — not a rehash of the earlier CVE-2026-33017 unauthenticated RCE covered by Labs in March 2026

Related Reading

• CVE-2026-105740: Langflow Authenticated RCE via MCP Stdio Transport
• Critical Langflow RCE Flaw Exploited Within 20 Hours of Disclosure
• CISA: New Langflow Flaw Actively Exploited to Hijack AI Workflows
• Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys

Sources

• Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts — The Hacker News