{"schema_version":"0.10.0","id":"LR-2026-0798","record_version":1,"title":"Langflow exploited in 1,423 honeypot attack attempts","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"43828a09caae063058822a829e05f05b68235a4e895d3142f449a42ae76fdd33"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Build AI applications and agentic workflows","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-09-19","date_disclosed":"2026-10-15","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Langflow, an open-source platform for building AI applications and agentic workflows, has a critical authenticated remote code execution flaw (CVE-2026-105740) in versions before 1.9.0. According to an alert from Previdian, threat actors are exploiting it. The flaw lets any authenticated user add an MCP server whose command field is passed to a shell with no validation, allowlisting or sandboxing, so the command runs when the server list is fetched. Previdian's honeypot sensors recorded 1,423 exploitation attempts from 27 IP addresses since September 19, 2026. In one observed sequence, attackers authenticated with a common username and password. The Hacker News reported the activity on 2026-10-15, and an update raised the total to 1,706 attempts from 28 addresses. The sources do not state that any production system was compromised. Previdian recommended patching, disabling auto-login and enforcing strong passwords.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Langflow accepts a user-provided command without restricting it to approved executables.","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK03","RK04"],"control_chain":[{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"A6","outcome":"missing","reason":null,"quote":"The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing.","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"E1","outcome":"missing","reason":null,"quote":"The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing.","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"C3","outcome":"missing","reason":null,"quote":"The server accepts and stores the attacker-supplied \"command\" without any validation.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: contained to one evaluation, no third party touched. The attempts are recorded only against Previdian's honeypot sensors, and the sources state no compromise of other parties' systems.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html","publisher":"The Hacker News","date":"2026-10-15","type":"press","title":"Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","event.date_occurred":"C","event.incident_class":"C","event.detection_method":"C","event.root_cause_detail":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows."}],"event.date_occurred":[{"source_index":0,"quote":"Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam."}],"event.incident_class":[{"source_index":0,"quote":"Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian."}],"event.detection_method":[{"source_index":0,"quote":"Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian."}],"event.root_cause_detail":[{"source_index":0,"quote":"The crux of the vulnerability is that Langflow accepts a user-provided command without restricting it to approved executables."}],"impact.severity":[{"source_index":0,"quote":"Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam."}],"impact.severity_because":[{"source_index":0,"quote":"Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam."}],"event.control_chain":[{"source_index":0,"quote":"The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing."},{"source_index":0,"quote":"The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing."},{"source_index":0,"quote":"The server accepts and stores the attacker-supplied \"command\" without any validation."}],"event.summary":[{"source_index":0,"quote":"Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows."},{"source_index":0,"quote":"Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian."},{"source_index":0,"quote":"The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing."},{"source_index":0,"quote":"Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam."},{"source_index":0,"quote":"In one observed sequence, attackers checked the Langflow version, attempted /api/v1/auto_login (which returned 403 as it was disabled in our honeypot), and then successfully authenticated using a common username and password."},{"source_index":0,"quote":"The total number of exploitation attempts has jumped to 1,706 and now originates from 28 unique IP addresses."}]},"notes_on_gaps":"The sources describe exploitation attempts against honeypot sensors. No successful compromise of a production Langflow deployment is stated. No autonomous agent is described as acting, so failure_class and secondary failure classes are left out and agent_involved is set to false as a judgement. Root cause is left out because no closed root_cause value fits a missing input validation flaw with confidence. Attacker identity and adversarial_actor are not stated beyond unknown threat actors from many IP addresses. event.date_occurred uses the start of the recorded window, September 19, 2026, as a judgement; the date the flaw was first exploited is not stated. date_detected, duration, time_to_contain and remediation dates are not stated. The developer, deployment context and affected organisation counts are not stated. Impact severity is minor as a judgement because the sources report attempts only against honeypots and state no third party touched. Auto-login being disabled in the honeypot is a control that held, but no listed control id matches it, so it is not linked. The advisory is cited through press quotations, not a primary Langflow report. The remediation entry is advice from Previdian's CEO and is not a fix reported by a party that changed its own system. The update figures are a later addition to the same article. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"reached","text":"Previdian's honeypot sensors recorded 1,423 exploitation attempts from 27 IP addresses since September 19, 2026.","quote":"Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.","source_index":0,"grade":"C"},{"step":"caught","text":"The activity was flagged through an alert from Previdian.","quote":"Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html"]},"analysis":{"sections":{"timeline":[{"text":"Recorded exploitation attempts against honeypot sensors start from this date.","quote":"Data from Previdian shows that 1,423 exploitation attempts have been recorded against its honeypot sensors since September 19, 2026, from 27 unique attacker IP addresses located in Belgium, China, Germany, Hong Kong, Japan, Nigeria, the Philippines, Russia, Seychelles, Singapore, South Korea, Taiwan, Tanzania, the U.S., and Vietnam.","source_index":0,"when":"2026-09-19"},{"text":"Exploitation efforts ramp up; 333 attempts registered.","quote":"The exploitation efforts ramped up starting October 11, 2026, when 333 attempts were registered.","source_index":0,"when":"2026-10-11"},{"text":"66 attempts observed as of writing.","quote":"As of writing, 66 attempts have been observed on October 15, 2026.","source_index":0,"when":"2026-10-15"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html"]}}