Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

1. Executive summary

Previdian has issued an alert covering active exploitation attempts against CVE-2026-105740, an OS command injection flaw in Langflow, the open-source AI and agentic workflow builder now owned by IBM. The vulnerability carries a CVSS score of 9.9 (critical) and is not listed in CISA's Known Exploited Vulnerabilities catalog; EPSS sits at 1%. The primary source reports 1,423 honeypot exploit attempts and describes the flaw as authenticated, which conflicts with the unauthenticated framing used across the related Langflow reporting, and that discrepancy is unresolved in the material available to us. EMEA financial services firms running Langflow, including any instance embedded in IBM watsonx.ai workflows, should treat exposed deployments as at risk and confirm version and configuration state before the end of the day.

2. Regulatory framing

No NIS2 or UK NIS article is engaged on the facts in this item. The source does not describe an incident at a specific entity, so the NIS2 Art. 23 and UK NIS 2018 reporting duties are not triggered by this advisory.

3. Technical analysis & attack chain

The verified reference data records CVE-2026-105740 as CWE-78, OS command injection, CVSS 9.9 critical, not in CISA KEV, EPSS 1%. The primary source describes it as an authenticated remote code execution flaw in Langflow and reports 1,423 honeypot exploit attempts. The source text supplied to us is truncated at the point where it would describe the vulnerability mechanism, so the specific injection point, the affected versions, and the authentication requirement are not established by the primary item.

The related sources describe a cluster of separate Langflow vulnerabilities that are being exploited in the same period, and these should not be conflated with CVE-2026-105740:

• CVE-2026-9198, added to CISA KEV, affects Langflow OSS 1.0.0 through 1.10.0, fixed in 1.10.1. It chains an auto-login endpoint that mints superuser tokens to any network caller with a code validation endpoint that executes arbitrary Python. The result is unauthenticated RCE on default deployments.
• CVE-2026-33017, CVSS 9.3, is an unauthenticated RCE in Langflow exploited to deliver a Monero cryptocurrency miner.
• CVE-2026-0768 is described as allowing unauthenticated attackers to execute arbitrary Python code remotely.
• GHSA-gqcf-9v26-p4pr covers Langflow OSS 1.0.0 through 1.10.1 and locates the flaw in the public flow build endpoint at /api/v1/build_public_tmp/{flow_id}/flow. The cause is an incomplete denylist in validate_public_flow_no_code_execution() that fails to block the OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent code-execution components.

The attack chain below is drawn from the CVE-2026-9198 reporting, which is the only related source that gives a full mechanism. It is not confirmed to apply to CVE-2026-105740.

1. The attacker reaches a default Langflow deployment over the network.
2. The auto-login endpoint issues a superuser token to the caller without authentication.
3. The attacker uses the superuser token against the code validation endpoint.
4. The endpoint executes attacker-supplied Python.
5. The attacker gains control of the Langflow server, and in the CVE-2026-33017 activity, deploys a Monero miner.

Confidence caveats. The 1,423 honeypot figure and the "authenticated" characterisation of CVE-2026-105740 rest on the primary source alone, which cites a Previdian alert we have not seen in full; treat both as single-sourced and verify before acting on them. The CVE-2026-9198 chain is corroborated across The Register and BleepingComputer. The CVE-2026-33017 Monero miner detail is single-sourced to The Hacker News. No MITRE ATT&CK profile is provided for any actor in the verified reference data, and no source in this set names a threat actor, so no attribution is made here.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every Langflow instance, including copies embedded in watsonx.ai, and record the running version. IBM states the affected range for CVE-2026-9198 is 1.0.0 through 1.10.0 and directs upgrades to 1.10.1 or later; the most recent release cited is 1.11.2.
• Where an instance cannot be patched immediately, disable the auto-login endpoint and restrict network access to the code validation and public flow build endpoints. The public flow build path to block is /api/v1/build_public_tmp/{flow_id}/flow.
• Search logs for superuser token issuance to unexpected source addresses and for calls to the code validation endpoint from outside the expected operator range.

P2, within 72 hours:

• Upgrade all Langflow OSS deployments to 1.11.2 or the current vendor release. Confirm the fix covers CVE-2026-105740 as well as CVE-2026-9198, CVE-2026-33017, and CVE-2026-0768; the primary source does not state a fixed version for CVE-2026-105740.
• Apply network policy so Langflow management and build endpoints are reachable only from approved management networks, not from the internet.
• Check for Monero mining activity on hosts running Langflow, given the CVE-2026-33017 activity.

P3, within 7 days:

• Add Langflow to the third-party risk register with the version, exposure, and patch state recorded, to support the DORA Art. 28 evidence trail.
• Include the Langflow build and code-validation endpoints in the next resilience test cycle under DORA Art. 24.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe behaviour only.

Behavioural indicators:

No copyable indicator block is provided because the sources contain no machine-pivotable atomic indicators.

6. Detection

The sources give usable artefacts for the public flow build endpoint and the code-execution components named in GHSA-gqcf-9v26-p4pr. The YARA rule below targets those strings in Langflow source or configuration files on disk.

rule Langflow_Public_Flow_Build_Code_Execution
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-15"
        reference = "https://github.com/advisories/GHSA-gqcf-9v26-p4pr"
        description = "Detects Langflow files referencing the public flow build endpoint and the code-execution agent components named in GHSA-gqcf-9v26-p4pr"
    strings:
        $ep = "/api/v1/build_public_tmp/" ascii
        $fn = "validate_public_flow_no_code_execution" ascii
        $a1 = "OpenDsStarAgent" ascii
        $a2 = "CodeActAgentSmolagents" ascii
        $a3 = "CSVAgent" ascii
    condition:
        uint32(0) != 0x04034b50 and 2 of them
}

The Sigma rule below detects requests to the public flow build endpoint in web access logs.

title: Langflow Public Flow Build Endpoint Access
id: 8f2c1a44-6b7e-4d21-9c3a-0e5f7a1b2d90
status: experimental
description: Detects HTTP requests to the Langflow public flow build endpoint associated with GHSA-gqcf-9v26-p4pr
author: Adverse Trace
date: 2026/10/15
references:

    - https://github.com/advisories/GHSA-gqcf-9v26-p4pr
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|contains: '/api/v1/build_public_tmp/'
    condition: selection
falsepositives:

    - Legitimate use of the public flow build feature by authorised operators
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, "Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts", https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html, 2026-10-15
• The Register Security, "IBM's agentic AI platform is under active attack - patch now", https://www.theregister.com/security/2026/08/05/ibms-agentic-ai-platform-is-under-active-attack-patch-now/5283535, 2026-08-05
• The Hacker News, "Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints", https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html
• SecurityWeek, "Hackers Start Exploiting Critical Langflow Vulnerability", https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/
• BleepingComputer, "CISA orders urgent action on actively exploited Langflow RCE flaw", https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-langflow-rce-flaw/
• GitHub Security Advisories, "IBM Langflow OSS 1.0.0 through 1.10.1 unauthenticated remote code execution", https://github.com/advisories/GHSA-gqcf-9v26-p4pr
• Dark Reading, "Critical Langflow Flaw Exploited as Attacks on AI Platform Rise", https://www.darkreading.com/vulnerabilities-threats/critical-langflow-flaw-exploited-attacks-rise

8. Adverse Trace position

Adverse Trace assesses CVE-2026-105740 as critical on the verified CVSS of 9.9, but we do not treat it as confirmed-exploited at scale: it is not in CISA KEV, EPSS is 1%, and the 1,423 honeypot figure is single-sourced to a Previdian alert we have not reviewed. The more immediate risk to clients is the cluster of Langflow flaws that are in KEV or actively exploited, CVE-2026-9198 in particular, because the affected version range and the fix are known and the exposure is on default deployments. We will attempt to obtain the full Previdian alert to resolve the authenticated versus unauthenticated discrepancy and to confirm whether a fixed version exists for CVE-2026-105740, and we will update this advisory if either changes the picture. Clients running Langflow should confirm version and endpoint exposure today and treat the P1 steps as the priority.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.