Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

Security firm Previdian reports active exploitation of a critical Langflow flaw tracked as CVE-2026-105740 (CVSS 9.9), which lets any logged-in user, even a non-admin account, run arbitrary system commands on the server. The bug stems from Langflow passing an attacker-controlled command field straight into a shell call when a malicious MCP server with 'stdio' transport is registered, with no validation, allowlisting or sandboxing, and it also permits injecting arbitrary environment variables. Previdian's honeypots logged 1,423 exploitation attempts from 27 distinct IP addresses across more than a dozen countries since September 19, 2026, with activity spiking in mid-October, and observed attackers harvesting secrets like LANGFLOW_SECRET_KEY, probing Docker and host files, and reusing one IP already tied to attacks on Flowise and other Langflow CVEs. Langflow, now owned by IBM via DataStax, urges users on versions before 1.9.0 to update immediately, disable auto-login, enforce strong unique passwords, and monitor MCP server endpoint logs for suspicious requests.