Artificial Intelligence · Cybersecurity
Langflow flaw drew 1,423 exploit attempts
Previdian said attackers were using an authenticated remote-code-execution flaw in Langflow, while honeypot data showed more than 1,400 attempts against its sensors since 19 September 2026 and signs of credential abuse.
- Previdian said Langflow had an authenticated remote-code-execution flaw, CVE-2026-105740, in versions before 1.9.0.
- The flaw let a logged-in user add an MCP server with stdio transport and trigger command execution when the server list was fetched.
- Previdian said its honeypots logged 1,423 attempts since 19 September 2026, including 333 on 11 October and 66 on 15 October.
- Ryan Dewhurst said some attackers checked the version, tried /api/v1/auto_login, then authenticated with common credentials and used the bearer token to reach the vulnerable endpoint.
- Langflow recommended patching, disabling auto-login, using strong passwords and reviewing logs; it had also fixed another critical command-injection flaw last month.
Previdian said threat actors were exploiting Langflow CVE-2026-105740, which affected releases before 1.9.0. The issue allowed an authenticated user to add an MCP server with stdio transport and run commands when the server list was loaded.
Langflow said the command would run with the privileges of the Langflow process. It also said the server entry could remain in project settings and run again later, which could support persistence and later movement across a system.
Previdian said its honeypots had recorded 1,423 attempts since 19 September 2026 from 27 IP addresses. It said the activity increased on 11 October and had reached 66 attempts on 15 October.
Dewhurst said attackers had checked the version, tried /api/v1/auto_login and then logged in with common credentials before using the bearer token on the vulnerable endpoint. Captured payloads included attempts to read environment variables, run docker commands and query basic system details.
Previdian and GreyNoise said much of the activity came from 192.255.229.92, which they had also linked to brute-force activity and exploits against Flowise and other Langflow flaws. Langflow advised patching, disabling auto-login, using unique passwords and checking logs.
Named in this story
People
- Ryan Dewhurst
- founded and led Previdian and described the attackers’ login path
Companies
- Previdian
- said the flaw was being exploited and counted honeypot attempts
- DataStax
- had owned Langflow before IBM bought it
- IBM
- acquired DataStax in February 2025
- GreyNoise
- was cited alongside Previdian in linking an IP to wider attack activity
Products and systems
- Langflow
- was the platform with the authenticated code-execution flaw
- Flowise
- was another platform that the same IP was said to have targeted
How the source tells it
A technical security warning with an urgent register, driven by exploit counts and remediation advice, and punctuated by descriptions of possible server compromise.
- urgency using active exploitation counts and immediate patching guidance to press for quick action
- alarm describing full compromise, lateral movement and a persistent backdoor as possible outcomes