Langflow flaw lets attackers run code on servers: 1,423 exploit attempts recorded

What is Langflow and why does this flaw matter?

Langflow is an open-source tool that helps developers build artificial intelligence (AI) applications and workflows. It is used by individuals and organisations to create custom AI solutions. In February 2025, IBM acquired DataStax, the parent company of Langflow. This means the platform is now backed by a major tech company, and its security is important for many users.

A critical vulnerability, tracked as CVE-2026-105740, was discovered in Langflow versions before 1.9.0. The flaw allows anyone with a valid Langflow account (not just admins) to run any command they want on the server. This is known as remote code execution (RCE). The vulnerability has a CVSS score of 9.9, which is considered extremely severe.

How attackers are exploiting the flaw

According to The Hacker News↗ (opens in a new tab), attackers have tried to exploit this flaw at least 1,423 times since 19 September 2026. These attempts were detected by honeypot sensors operated by security firm Previdian. Honeypots are decoy systems set up to attract and study attackers. The exploit attempts came from 27 different IP addresses across several countries, including the US, China, Germany, and Russia.

Attackers first try to log in to Langflow, sometimes using common or default passwords. Once logged in, they send a specially crafted request to add a malicious server configuration. This configuration includes a command field that is passed directly to the system's command line (bash) without any checks. When the server fetches its list of configurations, it runs the attacker's command. This can be used to steal sensitive data, install backdoors, or move further into the network.

What can happen if the flaw is exploited?

If an attacker successfully exploits this vulnerability, they can:

• Take full control of the server running Langflow
• Steal environment variables and secret keys (such as LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD)
• Read sensitive files from the server
• Install persistent malware that survives restarts
• Use the compromised server to attack other systems on the network

Some attackers have tried to extract environment variables and transmit them to external servers. Others have run commands to probe the system or read files like "/etc/passwd" (which lists user accounts on Unix systems).

What has been done and what should users do?

Langflow has released a patched version (1.9.0 and above) that fixes this vulnerability. The company also recommends:

• Upgrading to the latest version as soon as possible
• Disabling auto-login features
• Enforcing strong, unique passwords for all accounts
• Reviewing authentication logs and requests to the vulnerable endpoint for suspicious activity

If you cannot upgrade immediately, set LANGFLOW_AUTO_LOGIN to false and avoid exposing Langflow to the public internet. Only trusted users should have accounts.

Context: previous vulnerabilities and ongoing risks

Langflow has faced other serious vulnerabilities recently, including another critical flaw (CVE-2026-105697) that also allowed command injection. Attackers appear to be systematically targeting Langflow and similar platforms, possibly looking for exposed systems with weak security. The end goals of these attacks are not fully known.

Security professionals should monitor for signs of compromise and ensure that all AI development tools are kept up to date. Regularly reviewing user accounts and server configurations can help catch suspicious changes early.

What you should do now

If you use Langflow, check your version and update if necessary. Review your server logs for unusual activity, especially failed logins or unexpected requests to the server configuration API. Make sure your passwords are strong and unique, and restrict access to trusted users only. If you suspect your system has been compromised, investigate thoroughly and consider a full rebuild of the affected server.

For organisations, this incident is a reminder to treat AI development tools with the same security standards as any other critical software. Vulnerabilities in these platforms can lead to serious breaches if left unpatched.