CVE-2026-105740: Critical Langflow Authenticated RCE Under Active Exploitation — Detection and Remediation Guide

If your organization is building AI applications or agentic workflows on Langflow — and a growing number of enterprises are — you need to treat this as an urgent patching and hunting priority. According to an alert from Previdian, threat actors are actively targeting CVE-2026-105740, a critical authenticated remote code execution vulnerability in Langflow carrying a CVSS score of 9.9 — functionally the top of the severity scale. Honeypot operators have already recorded 1,423 attack attempts against the flaw, which tells us this is not academic interest or a researcher probing for bug bounties. This is mass scanning and exploitation behavior.

Langflow is an open-source platform for building AI applications and agentic workflows, and its profile has risen sharply since IBM acquired DataStax (Langflow's parent company) in February 2025. That enterprise pedigree matters for one reason: Langflow instances are increasingly sitting inside corporate networks with access to LLM API keys, vector databases, internal data sources, and downstream automation. A code execution foothold on a Langflow server is rarely the end of the attack — it is the beachhead.

This post breaks down what defenders need to know: the vulnerability's characteristics, exploitation status, and concrete detection and remediation guidance for SOC and vulnerability management teams.

Technical Analysis

What We Know

• CVE: CVE-2026-105740
• CVSS: 9.9 (Critical)
• Product: Langflow (open-source AI application and agentic workflow builder; parent company DataStax, acquired by IBM in February 2025)
• Vulnerability class: Authenticated remote code execution
• Exploitation status: Actively targeted in the wild. Previdian's honeypot network has logged 1,423 attack attempts against this flaw, indicating broad, automated exploitation scanning.

Why an "Authenticated" RCE With a 9.9 Score Should Still Terrify You

The word "authenticated" causes some teams to mentally downgrade severity. That is a mistake, and the 9.9 CVSS score reflects why. Several compounding factors make authenticated RCE in a platform like Langflow exceptionally dangerous:

1. Weak or default credentials are endemic in self-hosted AI tooling. Langflow instances are frequently deployed by data science and AI engineering teams — not security-hardened IT — often with default, weak, or shared credentials, or with authentication misconfigured entirely during rapid prototyping.
2. Credential stuffing and token leakage. AI platform credentials, API tokens, and session material leak constantly through GitHub repositories, CI logs, and compromised developer workstations. An attacker holding valid low-privilege credentials plus this RCE primitive owns the host.
3. Langflow's architecture amplifies impact. By design, Langflow executes user-defined flows, connects to external APIs, and processes data pipelines. Code execution in this context typically lands as the Python interpreter user running the Langflow server process — which often has plaintext access to LLM API keys (OpenAI, Anthropic, Azure OpenAI), database connection strings, and vector store credentials stored in its environment or database.

The Likely Attack Chain (Defender's View)

While the full technical write-up of CVE-2026-105740 is truncated in the source reporting, the observable exploitation behavior from honeypot telemetry follows a pattern consistent with authenticated RCE campaigns against Python-based web platforms:

1. Reconnaissance: Mass internet scanning (e.g., via Shodan/Censys-derived target lists) for Langflow instances, typically on default ports such as 7860 or behind reverse proxies.
2. Authentication: Use of default credentials, brute force, or previously leaked tokens to establish an authenticated session against the Langflow API.
3. Code execution: Submission of a crafted request to the vulnerable component, causing the Langflow server process (Python/uvicorn/gunicorn) to execute attacker-controlled code — typically spawning a system shell or interpreter subprocess.
4. Post-exploitation: Retrieval of environment variables and secrets, outbound connection to attacker infrastructure (reverse shell or C2), deployment of persistence, and lateral movement into the data plane the Langflow instance connects to.

The 1,423 honeypot hits indicate automated tooling is already weaponized. Assume scanning is global and that any internet-exposed Langflow instance has already been probed.

Detection & Response

The detections below target the most reliable observable behaviors of this exploitation pattern: the Langflow/Python server process spawning shell interpreters, suspicious API authentication anomalies, and unexpected outbound connections from Langflow hosts. They are tuned to avoid the noise floor of legitimate Langflow operation (which does involve Python subprocess activity for flow execution — scope your allowlists accordingly).

Sigma Rules

---
title: Langflow Server Process Spawning Shell or Script Interpreter
id: 3f8a1c42-7b2d-4e91-a5c6-9d0e2f4a8b1c
status: experimental
description: Detects a Langflow/uvicorn/gunicorn Python server process spawning a shell or script interpreter, consistent with exploitation of CVE-2026-105740 authenticated RCE. Legitimate Langflow flow execution rarely invokes system shells directly.
references:
  - https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'python'
      - 'uvicorn'
      - 'gunicorn'
      - 'langflow'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Langflow flows that legitimately execute custom Python components — review CommandLine for flow-related paths under the Langflow install directory
level: high
---
title: Suspicious Outbound Connection from Langflow Python Process
id: 8c2e4f1a-3d6b-4a78-9e2c-1f5b7d9a0e3f
status: experimental
description: Detects the Langflow server process (python/uvicorn/gunicorn) initiating outbound network connections to rare or non-LLM destinations, consistent with reverse shell or C2 activity following CVE-2026-105740 exploitation.
references:
  - https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'python'
      - 'uvicorn'
      - 'gunicorn'
      - 'langflow'
    DestinationPort:
      - 4444
      - 1337
      - 6667
      - 8081
      - 9001
  condition: selection
falsepositives:
  - Custom Langflow components connecting to non-standard internal service ports — baseline legitimate destinations per host before enabling
level: medium
---
title: Brute Force or Anomalous Authentication Against Langflow API Endpoint
id: 5d1a9b3c-8f4e-4c27-b6a1-2e8d4c7f0a5b
status: experimental
description: Detects repeated failed authentication attempts or authentication from a single source against Langflow web endpoints, a precursor to exploitation of the authenticated CVE-2026-105740 RCE. Tunable via threshold in your SIEM correlation layer.
references:
  - https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.credential_access
  - attack.t1110
  - attack.initial_access
logsource:
  category: webserver
  product: linux
detection:
  selection:
    cs-uri-stem|contains:
      - '/api/v1/login'
      - '/api/v1/auto_login'
      - '/login'
    sc-status:
      - 401
      - 403
  condition: selection
falsepositives:
  - Users with expired sessions or mistyped passwords — correlate on source IP count exceeding 10 failures in 5 minutes before alerting
level: medium

KQL (Microsoft Sentinel / Defender)

This hunt queries Syslog/CEF-ingested Linux web and process telemetry for the Langflow exploitation pattern: server processes spawning shells, plus authentication failure bursts against Langflow login endpoints. If your Langflow hosts forward logs to Sentinel via the Syslog or CommonSecurityLog connectors, this will surface the behavior.

// Hunt 1: Langflow server process spawning shells/interpreters (post-auth RCE behavior)
let Lookback = 7d;
let SuspiciousChildren = dynamic(["/bin/bash", "/bin/sh", "/bin/dash", "/usr/bin/curl", "/usr/bin/wget", "/usr/bin/nc", "/usr/bin/ncat", "/usr/bin/base64", "/usr/bin/perl"]);
Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName has_any ("python", "uvicorn", "gunicorn", "langflow")
| where SyslogMessage has_any ("bash", "sh -c", "curl", "wget", "nc ", "ncat", "base64 -d", "perl -e")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;
// Hunt 2: Authentication failure bursts against Langflow login endpoints (web/proxy logs via CEF)
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where RequestURL has_any ("/api/v1/login", "/api/v1/auto_login", "/login")
| where DeviceAction in ("401", "403", "failure", "denied")
| summarize FailedAttempts = count(), DistinctUsers = dcount(RequestContext) by SourceIP, DestinationHostName, bin(TimeGenerated, 5m)
| where FailedAttempts >= 10
| order by FailedAttempts desc;
// Hunt 3: Outbound connections from known Langflow hosts to rare destinations (Defender for Endpoint / firewall CEF)
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName has_any ("python", "python3", "uvicorn", "gunicorn")
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), DistinctPorts = dcount(RemotePort) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessCommandLine
| order by ConnectionCount asc  // rare connections surface first — triage these

Velociraptor VQL

Use this hunt artifact across suspected Langflow hosts to identify post-exploitation artifacts: shell processes parented to Python, and unexpected listening or established outbound sockets owned by the Langflow service user.

-- CVE-2026-105740 Langflow post-exploitation hunt
-- Identify Python/Langflow processes with shell children or suspicious command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)python|uvicorn|gunicorn|langflow'
   AND (CommandLine =~ '(?i)(bash|/bin/sh|curl|wget|nc |ncat|base64 -d|perl -e|chmod \+x|/tmp/)'))
   OR (Name =~ '(?i)^(bash|sh|dash)$')
ORDER BY CreateTime DESC

-- Follow-on: enumerate network sockets owned by the Langflow process user
SELECT Pid, Name, Family, Type, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)python|uvicorn|gunicorn|langflow'
  AND Status =~ 'ESTABLISHED|LISTEN'

Hardening & Verification Script

Run this on self-hosted Linux Langflow servers to identify the running version, check exposure, restrict network access to the service, and audit for post-exploitation artifacts. Update to the latest Langflow release via pip/Docker first — consult the official Langflow GitHub security advisory for CVE-2026-105740 for the fixed version.

#!/bin/bash
# CVE-2026-105740 Langflow exposure audit & hardening — run as root or via sudo

LANGFLOW_USER="langflow"
LANGFLOW_PORT="7860"

echo "=== [1] Installed Langflow version ==="
pip3 show langflow 2>/dev/null | grep -E '^(Name|Version)' || pip show langflow 2>/dev/null | grep -E '^(Name|Version)'
docker ps --format '{{.Image}}' 2>/dev/null | grep -i langflow

echo "=== [2] Is Langflow exposed beyond localhost? ==="
ss -tlnp | grep -E "(:${LANGFLOW_PORT}|langflow|uvicorn|gunicorn)"

echo "=== [3] Restrict Langflow bind to localhost (front with authenticated reverse proxy) ==="
# Set LANGFLOW_HOST=127.0.0.1 in your systemd unit / docker env, e.g.:
# Environment="LANGFLOW_HOST=127.0.0.1"
# Then: systemctl restart langflow

echo "=== [4] Check for shell children spawned by the Langflow process (IoC triage) ==="
LANGFLOW_PID=$(pgrep -f 'langflow|uvicorn|gunicorn' | head -1)
if [ -n "$LANGFLOW_PID" ]; then
  ps --ppid "$LANGFLOW_PID" -o pid,ppid,user,cmd
  echo "--- Outbound connections from Langflow process ---"
  ss -tnp | grep "pid=${LANGFLOW_PID}"
fi

echo "=== [5] Audit for dropped payloads and persistence ==="
find /tmp /var/tmp /dev/shm -type f -mtime -14 \( -name '*.sh' -o -name '*.py' -o -perm -111 \) -ls 2>/dev/null
crontab -l -u "$LANGFLOW_USER" 2>/dev/null
ls -la /home/${LANGFLOW_USER}/.ssh/ 2>/dev/null
grep -a 'api/v1/login' /var/log/nginx/access.log* 2>/dev/null | grep -E '" (401|403)' | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

echo "=== [6] Verify authentication is enforced ==="
# Ensure LANGFLOW_AUTO_LOGIN=false and a strong superuser password is set.
# Rotate ALL secrets accessible to the Langflow environment (LLM API keys, DB creds) if compromise is suspected.
env | grep -iE 'LANGFLOW_(AUTO_LOGIN|SUPERUSER)' 

echo "Done. Review output; investigate any unexpected shells, outbound sockets, or dropped files."

Remediation

1. Patch immediately. Upgrade Langflow to the latest released version containing the fix for CVE-2026-105740. Refer to the official Langflow GitHub repository security advisories and the IBM/DataStax advisory channels for the exact fixed version. If you run Langflow via Docker, pull the newest tagged image and redeploy — do not patch in place.
2. Remove internet exposure. A CVSS 9.9 authenticated RCE with 1,423 observed honeypot attacks means every internet-facing instance is a target. Place Langflow behind an authenticated reverse proxy or VPN, bind it to localhost or internal interfaces, and enforce allowlisting at the network perimeter.
3. Enforce strong authentication. Set LANGFLOW_AUTO_LOGIN=false, rotate all superuser and user credentials, and where possible front the application with SSO/MFA via your identity provider. Audit for accounts you don't recognize.
4. Hunt before you assume you're clean. Because exploitation is confirmed in the wild, treat patching as necessary but not sufficient. Run the detections above across any Langflow host that was internet-reachable. Look specifically for shell processes spawned by the Python server, unexpected outbound connections, dropped files in /tmp or /dev/shm, and new persistence mechanisms (cron, systemd units, SSH keys).
5. Rotate secrets on any potentially exposed instance. Langflow environments typically hold LLM API keys (OpenAI, Anthropic, Azure OpenAI), database connection strings, and vector store credentials. If there is any indication of compromise — or if the instance was unauthenticated or weakly authenticated while internet-exposed — rotate all of them and review cloud/API billing and usage logs for abuse.
6. Segment and constrain. Run Langflow as a dedicated low-privilege service account in a network segment isolated from production data stores. Apply egress filtering so the host can only reach the specific LLM and API endpoints it requires — this breaks reverse shells and C2 even if exploitation succeeds.
7. Add Langflow to your asset inventory and vuln management scope. AI tooling deployed by data science teams frequently lives outside formal IT inventory. This campaign is exactly why shadow AI infrastructure needs the same patch SLAs, logging, and EDR coverage as the rest of your estate.

The pattern here — a critical flaw in a fast-growing AI development platform, weaponized at scale within days — is one we've seen repeat across 2025 and 2026. AI infrastructure is now attack surface, and adversaries are scanning for it by name. Treat your Langflow deployment with the same urgency you would a VPN or firewall vulnerability, because that is effectively what it has become.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub