Loading story…
Attackers are actively targeting CVE-2026-105740, a critical authenticated remote code execution vulnerability affecting Langflow versions earlier than 1.9.0, with a reported CVSS score of 9.9. The flaw allows any authenticated user, including non-administrators, to configure a malicious Model Context Protocol (MCP) server using stdio transport and trigger arbitrary commands when the server list is fetched. Commands execute with the Langflow process’s privileges, potentially enabling host compromise, sensitive configuration theft, lateral movement, and persistent backdoors. Previdian recorded 1,423 honeypot exploitation attempts from 27 unique IP addresses beginning September 19, with activity increasing on October 11; MKD-CIRT and Bhutan’s incident response team also published alerts.
Observed attempts included accessing the host filesystem and stealing sensitive configuration values. In one attack, an unsuccessful auto-login attempt was followed by authentication using common credentials, after which the attacker used a bearer token to reach the vulnerable endpoint. Organizations should upgrade to Langflow 1.9.0 or a later fixed release, disable automatic login, strengthen credentials, restrict network exposure, and limit accounts to trusted users. Defenders should also review authentication logs and MCP server configurations for suspicious access or unauthorized changes, particularly on internet-accessible deployments.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Contributor alex700 added a Nuclei detection template for Langflow's authenticated MCP remote code execution vulnerability, CVE-2026-105740. A subsequent commit marked the template as verified following stated real-product validation, although the excerpt provides no test results.
Previdian observed an attacker authenticate with common credentials after automatic login failed, then use the bearer token to access the vulnerable MCP endpoint. Recorded attack commands attempted to steal environment variables and sensitive settings, send configuration data to 146.70.211[.]112:18764, and access the host filesystem through Docker.
Reporting described how CVE-2026-105740, rated CVSS 9.9 and affecting versions before 1.9.0, lets ordinary authenticated users store arbitrary shell commands in stdio MCP configurations and trigger execution by fetching the server list. Stored configurations can repeatedly execute commands with the Langflow process's privileges and permit arbitrary environment-variable injection.
Previdian observed 66 exploitation attempts on October 15 by the time of reporting, confirming continued activity against the vulnerability.
Previdian recorded 333 exploitation attempts against CVE-2026-105740, marking an increase in activity targeting its honeypots.
Previdian's honeypots began recording exploitation attempts against Langflow's authenticated remote code execution vulnerability. The observed campaign subsequently accumulated 1,423 attempts from 27 unique attacker IP addresses.
Langflow addressed CVE-2026-105697, a vulnerability rated CVSS 9.9 that allowed operating-system command injection through stdio-based MCP server configurations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcemkd-cirt.mk
Open sourcethehackernews.com
Open sourcebtcirt.bt
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting **CVE-2026-0768**, a critical unauthenticated remote-code-execution flaw in the Langflow AI low-code platform. Rated CVSS 9.8, the vulnerability affects Langflow versions through 1.4.2 and allows arbitrary Python code execution as root through insufficient validation in the custom-component editor’s code validator. VulnCheck recorded more than 360 exploitation attempts against U.K. canaries, largely from Russian-origin infrastructure, seeking environment variables, Langflow secrets, SSH details, and shell-history metadata. The activity follows broader disclosures affecting Langflow OSS 1.x releases prior to 1.11.2, including critical and high-severity flaws enabling RCE, privilege escalation, arbitrary file reads, and information disclosure. Organizations should upgrade Langflow to the vendor-fixed releases—at least 1.11.2 where applicable—remove public exposure where possible, rotate credentials accessible to Langflow, and investigate for unauthorized environment-variable access, proxy deployment, cryptomining, audit-log changes, and lateral scanning. Public exploit development is also progressing: a proposed Metasploit module targets the separate authenticated RCE **CVE-2026-5027**.
Sep 3, 2026
A critical vulnerability in the LangChain-based no-code LLM development platform **Langflow** exposed internet-facing instances to unauthenticated remote code execution. Tracked as **`CVE-2025-3248`** and rated **CVSS 9.8**, the flaw was disclosed after researchers showed that unsafe use of Python `exec` could be abused through Langflow's code-validation functionality, allowing attackers to run arbitrary Python on vulnerable servers. Security monitoring by MBSD-SOC found exploitation attempts beginning on **April 10, 2025**, shortly after public disclosure on April 8. Attackers were observed sending crafted `POST` requests to the **`/api/v1/validate/code`** endpoint to execute malicious Python, including attempts to read sensitive files such as **`/etc/passwd`**. The report said proof-of-concept code and real-world abuse were already circulating, and urged organizations to update Langflow immediately; telemetry cited the **Netherlands** and **France** as the source of roughly half of observed attack traffic.
Apr 10, 2025
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 10, 2026