Langflow RCE vulnerability sees 1,423 honeypot exploitation attempts

Previdian has recorded 1,423 attempts to exploit CVE-2026-105740, a critical authenticated remote-code-execution vulnerability in Langflow, since 19 September 2026. The attempts hit its honeypot sensors from 27 distinct IP addresses, with activity rising to 333 attempts on 11 October and 66 observed on 15 October.

Langflow is an open-source platform for building AI applications and agentic workflows. The flaw, rated CVSS 9.9, affects releases before version 1.9.0 and concerns configuration of Model Context Protocol (MCP) servers using the stdio transport.

Authenticated users can invoke shell commands

Langflow said any authenticated user, including a non-administrator, can obtain remote code execution with the privileges of the Langflow process. A user-supplied command is passed directly to bash -c without validation, allowlisting or sandboxing, and it executes when the MCP server list is fetched.

An attacker can log in with a regular account, send a crafted POST request to /api/v2/mcp/servers/{server_name}, and save a malicious command in the server configuration. A subsequent GET request to /api/v2/mcp/servers?action_count=true triggers that command. The env field also permits arbitrary environment-variable injection, including values such as LD_PRELOAD or a modified PATH.

The persistence risk is material because the MCP configuration remains stored and can execute again whenever the server list is loaded. Langflow also noted that these settings reside in project settings rather than appearing during normal flow-editor review. The operational abuse pattern aligns with Langflow endpoints targeted for Monero mining where exposed AI endpoints were targeted for Monero-mining activity.

Captured activity shows credential and secret hunting

Ryan Dewhurst, founder and CEO of Previdian, said one observed sequence began with a Langflow version check and a request to /api/v1/auto_login. After that request returned HTTP 403 in the honeypot, the actors authenticated with a common username and password, then used the bearer token against the MCP server configuration endpoint.

Captured payloads attempted to collect environment variables and Langflow configuration values, including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, and send them to an external address. Other commands sought Docker access to the host filesystem, read /etc/passwd, or ran simple checks such as id and whoami.

Langflow addressed another critical MCP stdio configuration issue, CVE-2026-105697, last month. Organisations should upgrade to a patched Langflow version, disable auto-login, use strong unique credentials, limit accounts to trusted users and avoid direct exposure to untrusted networks. Security teams should also review authentication events and requests to /api/v2/mcp/servers/ for suspicious configuration activity.