Langflow RCE Draws 1,423 Attacks: Patch to 1.9.0

CVE-2026-105740 is a CVSS 9.9 authenticated remote code execution flaw in Langflow prior to version 1.9.0. According to a Previdian alert, 1,423 honeypot exploitation attempts have been logged since September 19, 2026, with activity rising sharply on October 11 (333 attempts in a single day) from 27 unique attacker IPs across 15 countries.

The vulnerability

Any authenticated Langflow user can achieve server-side RCE by adding an MCP server with the stdio transport type. User-supplied commands reach bash with no sandboxing or allowlisting. CVSS 9.9 reflects the low barrier: authentication is the only prerequisite, and on multi-tenant Langflow deployments that means any registered user qualifies.

The flaw is present in all versions before 1.9.0 and is fixed in that release. Full details are in GitHub Advisory GHSA-7w94-79vh-5mr2. Langflow is maintained under DataStax, which IBM acquired in February 2025.

What to do

Upgrade to Langflow 1.9.0. If you run a multi-tenant or shared instance, treat this as urgent: authenticated RCE with over 1,400 recorded attempts against honeypots is past the theoretical stage.

If you cannot upgrade immediately, restrict MCP server configuration to trusted admin accounts only while you prepare the update.

Priority call

Authentication-required does not mean low risk on shared deployments. Update this week, sooner if you run a public-facing Langflow instance.

Related: CVE-2026-110447: Collabora CODE Server Exploited, Critical Ghostscript Flaw Lets PDFs Execute Code, AhsayCBS Backup Platform Exploited, No Patch Ready