Attackers Target Critical Langflow Flaw That Lets Any Logged-In User Take Over the Server

Attackers are exploiting a critical vulnerability in Langflow, an open-source platform developers use to build AI applications and agentic workflows. The flaw, tracked as CVE-2026-105740 (CVSS score: 9.9), affects versions before 1.9.0. According to an alert from Previdian, 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique IP addresses across 15 countries.

The problem is that Langflow accepts a command supplied by the user when an MCP server is added, without limiting it to approved programs. The advisory says this input is passed to the shell with no validation, allowlisting or sandboxing. Any authenticated user, including non-admin accounts, can run operating system commands on the server with the privileges of the Langflow process. Successful exploitation can lead to full server compromise, lateral movement and a persistent backdoor. The malicious configuration is saved and runs again each time the server list is loaded. Langflow also notes that these configurations are stored in project settings and are not visible during normal flow review.

Activity has been rising. Previdian saw 333 attempts on October 11, 2026, and 66 attempts on October 15, 2026, as of writing. This is only the opening of the original report, so further details may exist beyond what is covered here.