Langflow CVE-2026-105740 Authenticated RCE Hit by 1,706 Honeypot Exploit Attempts

Date: 2026-10-16
Tags: mcp-security, malware

Executive Summary

Threat actors are actively exploiting CVE-2026-105740, a critical authenticated remote code execution flaw in Langflow prior to version 1.9.0, with at least 1,706 exploitation attempts against Previdian honeypots from 28 unique IP addresses. Any authenticated user, including non admin accounts, can add an MCP server with the stdio transport whose command field is passed unvalidated to bash, achieving code execution that persists on every server list fetch. Defenders should upgrade Langflow to 1.9.0 or later and audit MCP server configurations for attacker supplied command and env fields.

Campaign Summary

Detailed Findings

According to The Hacker News, citing a Previdian alert, CVE-2026-105740 (CVSS 9.9) is an authenticated remote code execution flaw in Langflow affecting versions prior to 1.9.0. The advisory states that any authenticated Langflow user can achieve remote code execution by adding an MCP server with the stdio transport, because the user supplied command field is passed directly to bash with zero validation, no allowlisting, and no sandboxing, and executes immediately when the server list is fetched. The env field also permits arbitrary environment variable injection such as LD_PRELOAD or PATH override. The Hacker News reported that Previdian honeypot sensors recorded 1,423 attempts from 27 unique IP addresses since September 19, 2026, rising to 1,706 attempts from 28 unique IP addresses by October 15, with exploitation ramping up from October 11. Attackers checked the Langflow version, attempted the auto login endpoint, then authenticated with common credentials before using the bearer token to reach the vulnerable MCP endpoint. Observed payloads extracted environment variables including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD to a remote host, ran Docker commands to read /etc/passwd, and executed id and whoami probes. The malicious MCP server configuration persists and re-executes on every server list load, enabling a persistent backdoor. Source IPs were observed across Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam. This is a newly disclosed CVE and distinct from the earlier JADEPUFFER Langflow extortion reporting.

MITRE ATT&CK Mapping

IOCs

Domains

_Exfiltration destination IP 146.70.211[.]112:18764 reported by Previdian via The Hacker News. Worth noting 146.70.211.112 belongs to a hosting provider and may be reused infrastructure._

Full URL Paths

_Exfiltration destination IP 146.70.211[.]112:18764 reported by Previdian via The Hacker News. Worth noting 146.70.211.112 belongs to a hosting provider and may be reused infrastructure._

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

Langflow < 1.9.0

Detection Recommendations

Upgrade Langflow to 1.9.0 or later. Audit stored MCP server configurations and alert when any command or env field is added to a stdio transport entry. Monitor for POST requests to /api/v2/mcp/servers/{server_name} followed by GET requests to /api/v2/mcp/servers?action_count=true. Watch for repeated auto login attempts against /api/v1/auto_login and subsequent bearer token use. Alert on environment variable reads referencing LANGFLOW_SECRET_KEY or LANGFLOW_SUPERUSER_PASSWORD and on Docker or shell probes such as id, whoami, and /etc/passwd access. Restrict database and configuration storage permissions so a compromised process cannot persist new MCP entries.

References

• [The Hacker News] Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts (2026-10-15) — https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html