Honeypots run by Previdian recorded 1,423 attempts to exploit a critical flaw in Langflow, the open-source framework developers use to wire together AI agents and workflows. Security researchers counted those requests from 27 distinct addresses between September 19 and October 15, 2026, and the traffic surged sharply on October 11.
The flaw is tracked as CVE-2026-105740 and carries a CVSS score of 9.9. Every release before 1.9.0 is vulnerable, and the attack needs nothing more than an ordinary account — a non-admin login will do.
A single text box in MCP server setup is where the trouble starts. Add an MCP server that uses the stdio transport and whatever you type into the command field goes straight to bash. No validation runs, no allowlist is consulted, and nothing sandboxes the call. The command executes as soon as Langflow fetches the server list.
Worse, that setting is saved with the project. Each time the list reloads, the command runs again, so an attacker ends up with persistence that survives a reboot — and the flow editor, where most reviewers spend their attention, shows nothing.
Secrets and Docker commands among the payloads
Several captured payloads harvested environment variables and Langflow’s internal secrets, among them LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, before sending the results to a remote server. Others issued Docker commands aimed at the host filesystem, and some merely ran id or whoami to see who they were.
Default logins were what most honeypot hits used, which points to a cheap fix. Rotate the default credentials, keep the instance off the public internet, and move to 1.9.0 or newer.
