hacker-news Oct 15, 2026 · Crawled Oct 15, 2026

Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

2 IoCs 6 CVEs

AI Summary

A critical authenticated remote code execution vulnerability, CVE-2026-105740 (CVSS 9.9), in the open-source AI platform Langflow is being actively exploited by threat actors. The flaw allows any authenticated user to execute arbitrary OS commands on the server via maliciously crafted MCP server configurations using the 'stdio' transport, with no input validation or sandboxing. Previdian recorded 1,423 exploit attempts from 27 unique IP addresses since September 19, 2026, with increased activity starting October 11. Attackers are using stolen credentials or weak passwords to authenticate and then deploy payloads to extract environment variables, execute system commands, and attempt lateral movement. Immediate mitigation includes upgrading to a patched version, disabling auto-login, and restricting access to trusted users.

AI-extracted · verify before operational use

Extracted Entities 6 found

CVE CVE-2026-105740 → CVE CVE-2026-69255 → CVE CVE-2026-55255 → CVE CVE-2026-9198 → CVE CVE-2026-0768 → CVE CVE-2026-105697 →

Indicators of Compromise 2 extracted

Type	Value	Detail
IP	146[.]70[.]211[.]112	Details →
IP	192[.]255[.]229[.]92	Details →

MITRE ATT&CK TTPs 24 techniques

T1003 OS Credential Dumping · Credential Access T1059.001 PowerShell · Execution T1078 Valid Accounts · Defense Evasion T1083 File and Directory Discovery · Discovery T1204.002 Malicious File · Execution T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.003 Windows Command Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1486 Data Encrypted for Impact · Impact T1499 Endpoint Denial of Service · Impact T1552 Unsecured Credentials · Credential Access T1619 Cloud Storage Object Discovery · Discovery T1190 Exploit Public-Facing Application · Initial Access T1484 Domain or Tenant Policy Modification · Defense Evasion T1021 Remote Services · Lateral Movement T1485 Data Destruction · Impact T1566 Phishing · Initial Access