Langflow flaw draws 1,423 exploit attempts against honeypots

Attackers have made 1,423 exploitation attempts against Previdian's honeypots targeting a critical Langflow vulnerability, The Hacker News reported. The flaw, CVE-2026-105740, affects versions before 1.9.0 and lets authenticated users, including non-admin accounts, execute commands on the server. Langflow passes commands from configurations for external tool servers directly to a shell without validation or sandboxing. Malicious configurations persist and execute again when the server list loads. Previdian recorded attempts from 27 attacker IP addresses since September 19, including 66 on October 15. In one observed sequence, attackers authenticated with a common username and password before accessing the vulnerable configuration endpoint.