Security firm Previdian said attackers are exploiting Langflow, an open-source tool for building AI agents. The flaw, CVE-2026-105740, hits versions before 1.9.0 and has a CVSS severity rating of 9.9, The Hacker News reported on 15 October. Any logged-in user can add an MCP server (a connector for AI tools) and make the host run their commands. Previdian's decoy servers, called honeypots, logged 1,423 attempts from 27 IP addresses since 19 September. Activity rose on 11 October, with 333 attempts.
Previdian's founder, Ryan Dewhurst, told The Hacker News how attackers got in. On the honeypot, they found auto-login off, then signed in with a common username and password. One IP address also tried to read environment variables. GreyNoise and Previdian data tie it to attacks on other Langflow flaws and one in Flowise. The Hacker News said the actor is unknown and the goals are unclear. No count of real servers broken into is given; all figures come from honeypots.
Teams running Langflow before 1.9.0 face a flaw that needs only an ordinary account, and weak passwords were enough to get one on the honeypot. Version 1.9.0 fixes it. Dewhurst advised upgrading, turning off auto-login, using strong unique passwords, and checking logs for requests to /api/v2/mcp/servers/.