The framing matters. Langflow’s critical RCE (CVE-2026-105740, CVSS 9.9) is authenticated, which normally requires valid credentials. But 1,423 exploitation attempts from 27 IP addresses in less than a month suggest that boundary is fragile.
The vulnerability lives in the MCP stdio transport: user-supplied commands bypass validation and pipe directly to bash -c. Once an attacker has credentials, the attack is trivial. The malicious configuration persists across restarts and re-executes automatically.
The real puzzle is why such a high-friction attack sees mass honeypot hits. Either Langflow deployments commonly expose the interface to untrusted users, or default credentials are weak enough for bulk targeting. The timing suggests coordination: attacks began September 19, then spiked on October 11 (333 in one day). If the barrier is just weak credentials or bad network segmentation, the 1,423 attempts reveal a deployment problem, not a code bug.
Sources: GitHub Security Advisory GHSA-7w94-79vh-5mr2: Langflow Authenticated RCE • The Hacker News: Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts • CVE-2026-105740: Langflow OS Command Injection
Related on this blog: [AUTO] AI-Generated Patches Fail at Scale • [AUTO] Langflow RCE Added to KEV After a Month of Silence • [AUTO] AI’s Vulnerability Discovery Outpaces the Validation Pipeline