Langflow Exploit Attempts Surge Amid Authenticated RCE Flaw

1,423 exploitation attempts have been recorded against a critical authenticated remote-code-execution flaw in Langflow, Previdian data shows — a spike that underlines the speed with which attackers chase high-scoring vulnerabilities.

The bug: CVE-2026-105740 and why it is immediately dangerous

The vulnerability, tracked as CVE-2026-105740 with a CVSS score of 9.9, affects Langflow versions prior to 1.9.0 and permits authenticated remote code execution. As Langflow described in an advisory, "Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the 'stdio' transport." The advisory says the user-supplied command is passed directly to bash -c "exec {{command}}" with no validation, allowlisting, or sandboxing, and that the env field permits arbitrary environment-variable injection, including LD_PRELOAD and PATH overrides.

How an attacker can weaponize it, step by step

The exploitation path laid out in published materials is straightforward and requires only an authenticated account. The sequence demonstrated in the advisory and in Previdian's analysis is:

• Login as a regular, non-admin Langflow user;
• Submit a crafted HTTP POST to /api/v2/mcp/servers/{{server_name}} that places a malicious command (for example, a reverse shell) in the command field of an MCP server configuration;
• The server accepts and persists the attacker-supplied command without validation;
• Trigger execution by requesting the MCP server list via GET /api/v2/mcp/servers?action_count=true, which causes the stored command to run.

Langflow warned that "Any authenticated Langflow user (including non-admin accounts) can execute arbitrary OS commands on the server with the privileges of the Langflow process," and that MCP server configurations "persist and re-execute every time the server list is loaded." Langflow also noted that MCP server configs are stored in project settings and are not visible during normal flow review, increasing the chance of unnoticed persistence.

Observed exploitation: 1,423 attempts, 27 IPs, six weeks of activity

Previdian's honeypots logged 1,423 exploitation attempts against this flaw starting September 19, 2026, sourced from 27 unique attacker IP addresses distributed across Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam. Activity intensified beginning October 11, 2026, when 333 attempts were registered; 66 attempts were observed on October 15, 2026, according to the same dataset.

Previdian founder and CEO Ryan Dewhurst told The Hacker News that attackers often obtain authentication before exploiting the bug. In one observed sequence he described, attackers "checked the Langflow version, attempted /api/v1/auto_login (which returned 403 as it was disabled in our honeypot), and then successfully authenticated using a common username and password. They immediately used the resulting bearer token to access the vulnerable MCP server configuration endpoint."

Payloads seen and a persistent actor of interest

Captured payloads show offensive intent beyond simple probes. Payloads included attempts to extract environment variables and secret configuration values such as LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and to transmit them to 146.70.211[.]112:18764. Other probes delivered Docker commands to access the host filesystem and read /etc/passwd, and executed id, whoami, and similar reconnaissance commands.

A notable share of activity came from 192.255.229[.]92, which Previdian data and GreyNoise analysis show attempting environment-variable exfiltration and engaging in generic brute-force activity. GreyNoise links the same IP to exploitation attempts against other projects and CVEs, including Flowise (CVE-2026-69255) and a set of Langflow-related vulnerabilities (CVE-2026-55255, CVE-2026-9198, and CVE-2026-0768).

Mitigations and operational advice

Langflow and Previdian advise patching to a fixed release as the primary mitigation: upgrade to a patched version (versions prior to 1.9.0 are vulnerable). Ryan Dewhurst recommended several immediate controls: "We recommend upgrading Langflow to a patched version, disabling auto-login, enforcing strong and unique passwords, and reviewing authentication logs and requests to /api/v2/mcp/servers/ for suspicious activity." The advisory also noted that if immediate patching is impossible, operators should set LANGFLOW_AUTO_LOGIN=false, avoid exposing Langflow directly to untrusted networks, and limit Langflow accounts to trusted users.

Operators should pay special attention to authentication logs and bearer tokens tied to MCP server configuration endpoints, because the attack model observed by Previdian shows threat actors authenticating with common credentials then invoking the vulnerable endpoint to persist and execute payloads.

Last month Langflow also fixed an earlier, related critical issue (CVE-2026-105697, CVSS score: 9.9) that could permit OS command injection via MCP stdio server configurations — a reminder that the MCP stdio surface has been a repeated target.

The combination of a trivially weaponizable request pattern, stored-and-reexecuted malicious configuration, and active scanning and exploitation in the wild makes this a high-priority operational problem for anyone running Langflow instances. For defenders who cannot patch immediately, restricting network exposure, enforcing stronger authentication, and monitoring for POSTs to /api/v2/mcp/servers/ should be treated as urgent, compensating controls.

https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html