Langflow's CVSS 9.9 MCP flaw has drawn 1,423 honeypot exploit attempts from 27 IPs
Attackers made 1,423 attempts against Previdian honeypots since September 19 to exploit Langflow CVE-2026-105740 (CVSS 9.9, versions before 1.9.0). In one sequence they got the required login with a common username and password, Previdian said.
The Watch · Security desk
Three figures from Previdian: 333 exploitation attempts registered on October 11, 2026, when attempts ramped up; 66 attempts observed on October 15, 2026, as of writing; and 1,423 attempts recorded by honeypot sensors since September 19, 2026.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Attempts registered on October 11, 2026 | 333 attempts | 9 | |
| Attempts observed on October 15, 2026 | 66 attempts | as of writing | 9 |
| Attempts recorded since September 19 | 1,423 attempts | Previdian honeypot sensors | 7 |
What happened
- Langflow passes the command field of a stdio MCP server straight to bash with no validation, allowlisting or sandboxing, and runs it as soon as the server list is fetched.
- The exploit takes two requests: a POST that stores the malicious command, then a GET on the MCP server list that triggers it.
- Some payloads tried to send LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD to 146.70.211[.]112:18764.
- One address, 192.255.229[.]92, accounts for a significant chunk of the activity, and GreyNoise ties it to attacks on three other Langflow CVEs and one Flowise CVE.
Why it matters
- exposure Admin rights are no barrier. Every account on an unpatched instance, including non-admin ones, is a route to a shell as the Langflow process.
- cost If an exfiltration attempt lands, the secret key and superuser password have to be rotated, and the upgrade does not reverse that read.
- decision Anyone who can log in can add an MCP server, so until an instance runs a patched release, the list of accounts is the interim control.
- precedent Patching this CVE does not close the Langflow exposure: the same address has tried three other Langflow CVEs, so version hygiene has to cover the whole product.
The login requirement is the only gate on this bug, and Previdian watched attackers pass it with a common password. Ryan Dewhurst, founder and CEO of Previdian, described the sequence to The Hacker News. Dewhurst said: "In one observed sequence, attackers checked the Langflow version, attempted /api/v1/auto_login (which returned 403 as it was disabled in our honeypot), and then successfully authenticated using a common username and password. They immediately used the resulting bearer token to access the vulnerable MCP server configuration endpoint." [10]
We rate exploitability as high for any reachable instance with a weak or reused login. Once authenticated, the attacker needs two requests, a POST and a GET [3]. The affected range is every version before 1.9.0 [1]. Dewhurst's advice covers the login as well as the version: "We recommend upgrading Langflow to a patched version, disabling auto-login, enforcing strong and unique passwords, and reviewing authentication logs and requests to /api/v2/mcp/servers/ for suspicious activity," Dewhurst said. [15]
A planted entry outlasts the request that created it. The attacker's MCP server entry stays in the configuration and runs again each time the server list loads [5]. "Unlike custom component code which is visible in the flow editor, MCP server configs are stored in project settings and are not visible during normal flow review," Langflow said. [6] The source does not say whether the update clears entries planted before it. In our view, any instance that ran an affected version while reachable needs its project settings checked for MCP server entries after the upgrade.
Previdian recorded the 1,423 attempts on its honeypot sensors, from 27 addresses [7] in 15 locations [19], so the count measures attacker interest in the bug. The 333 attempts on October 11 are 23.4% of the total [18]. The 66 on October 15 was a count as of writing, so that day was incomplete [9]. Other captured payloads were Docker commands that tried to read /etc/passwd on the host [12] and id and whoami probes [13].
The advisory for this bug was released last month, according to The Hacker News [17]. Langflow also addressed a second CVSS 9.9 flaw, CVE-2026-105697, last month [16].
What to watch
- Whether Previdian or other vendors report confirmed compromises of production Langflow instances, as opposed to honeypot hits.
- Whether daily attempts after October 15 stay near the October 11 level of 333 or fall back.
- Whether 146.70.211[.]112:18764 or 192.255.229[.]92 show up in other telemetry tied to Langflow or Flowise attacks.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence65
- Adoption
- Insufficient
- Hype gap−5
- Incentives40
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-105740 (CVSS 9.9) is an authenticated remote code execution flaw in Langflow versions prior to 1.9.0.
- [2]
Per the advisory, any authenticated Langflow user can achieve RCE by adding an MCP server with the stdio transport; the user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting and no sandboxing, and executes immediately when the server list is fetched. The env field also allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override).
- [3]
The attack sequence is: log in as a regular non-admin user, send an HTTP POST to /api/v2/mcp/servers/{server_name} with a malicious command field (e.g., a reverse shell), then fetch the server list with an HTTP GET to /api/v2/mcp/servers?action_count=true, which causes the command to execute.
- [4]
Langflow warned that any authenticated Langflow user, including non-admin accounts, can execute arbitrary OS commands on the server with the privileges of the Langflow process.
- [5]
Successful exploitation can result in full server compromise, environment variable injection, lateral movement and a persistent backdoor, because the malicious MCP server configuration persists and re-executes every time the server list is loaded.
- [6]
"Unlike custom component code which is visible in the flow editor, MCP server configs are stored in project settings and are not visible during normal flow review," Langflow said.
- [7]
Previdian's honeypot sensors have recorded 1,423 exploitation attempts since September 19, 2026, from 27 unique attacker IP addresses.
- [8]
The attacker IP addresses are located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S. and Vietnam.
- [9]
Exploitation attempts ramped up starting October 11, 2026, when 333 attempts were registered; as of writing, 66 attempts had been observed on October 15, 2026.
- [10]
"In one observed sequence, attackers checked the Langflow version, attempted /api/v1/auto_login (which returned 403 as it was disabled in our honeypot), and then successfully authenticated using a common username and password. They immediately used the resulting bearer token to access the vulnerable MCP server configuration endpoint."
- [11]
Captured payloads include attempts to extract environment variables and sensitive Langflow configuration, including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, and transmit them to 146.70.211[.]112:18764.
- [12]
Captured payloads include Docker commands attempting to access the host filesystem and read the contents of /etc/passwd.
- [13]
Captured payloads include command execution probes using id, whoami and other simple commands.
- [14]
A significant chunk of the activity originates from 192.255.229[.]92, observed attempting to extract environment variables; GreyNoise data shows that address has engaged in generic brute-force attacks and exploited Flowise (CVE-2026-69255) and Langflow (CVE-2026-55255, CVE-2026-9198, CVE-2026-0768) flaws.
- [15]
"We recommend upgrading Langflow to a patched version, disabling auto-login, enforcing strong and unique passwords, and reviewing authentication logs and requests to /api/v2/mcp/servers/ for suspicious activity," Dewhurst said.
- [16]
Last month, Langflow also addressed another critical vulnerability, CVE-2026-105697, rated CVSS 9.9.
- [17]
The advisory for CVE-2026-105740 was released last month.
- [18]
The 333 attempts on October 11, 2026 are 23.4% of the 1,423 attempts recorded since September 19, 2026.
- [19]
The attacker IP addresses are spread across 15 listed locations.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.