Langflow CVE-2026-105740 Draws 1,423 Honeypot Exploit Attempts
Summary
Previdian recorded 1,423 attempts to exploit Langflow’s authenticated RCE flaw, CVE-2026-105740, in honeypot sensors since September 19. The flaw affects versions before 1.9.0 and can let authenticated users run OS commands.
Key points
- CVE-2026-105740 (CVSS 9.9) affects Langflow versions before 1.9.0 and allows any authenticated user, including non-admins, to execute OS commands on the server.
- The flaw arises when an MCP server uses the stdio transport: a user-supplied command is passed to bash without validation, allowlisting, or sandboxing.
- Previdian reported 1,423 honeypot exploitation attempts from 27 unique attacker IP addresses since September 19, 2026; activity increased from October 11.
- In an observed sequence, attackers checked the Langflow version, attempted auto-login, then authenticated with a common username and password before accessing the vulnerable MCP configuration endpoint.
- A captured IP, 192.255.229[.]92, was observed attempting to extract environment variables; GreyNoise also attributed other brute-force and vulnerability-exploitation activity to it.
- Langflow warned that malicious MCP server configurations can persist and re-execute when the server list is loaded, potentially enabling server compromise and backdoor deployment.
- Recommendations include upgrading to a patched version, disabling auto-login, enforcing strong unique passwords, reviewing authentication logs and MCP server requests, and limiting exposure to untrusted networks.
Article Details
- Vulnerability Types
- Authenticated remote code execution
- OS command injection
- Environment variable injection
- Severity
- Critical (CVSS 9.9)
- Affected Versions
- Langflow versions prior to 1.9.0
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Set LANGFLOW_AUTO_LOGIN=false.
- Avoid exposing Langflow directly to untrusted networks.
- Grant Langflow accounts only to trusted users.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]255[.]229[.]92 | Attacker IP reported as a significant source of exploitation activity and attempts to extract environment variables. |
MITRE ATT&CK
T1059.004 · Unix ShellThe flaw allows an authenticated user to execute attacker-supplied commands through bash -c.T1078 · Valid AccountsIn an observed sequence, attackers authenticated with a common username and password and used the resulting bearer token to access the vulnerable MCP server configuration endpoint.
CVE
CVE-2026-105697Last month, Langflow also addressed another critical vulnerability (CVE-2026-105697, CVSS score: 9.9) that could also result in operating system command injection through MCP stdio server configuration.CVE-2026-105740The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of authenticated remote code execution impacting versions prior to 1.9.0.
People
Products
Flowisethat the IP address has engaged in generic brute-force attacks, as well as exploiting other flaws in Flowise (CVE-2026-69255) and Langflow (CVE-2026-55255, CVE-2026-9198, and CVE-2026-0768).LangflowThreat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Countries
Belgiumagainst its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea,Chinaits honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan,Germanysensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan,Hong Kongsince September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, theJapanSeptember 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., andNigeria19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.Philippines27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.Russiaattacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.SeychellesIP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.Singaporelocated in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.South Koreain Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.TaiwanChina, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.TanzaniaGermany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.United StatesKong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.VietnamNigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.