Cases › security breach › LR-2026-0798
Langflow exploited in 1,423 honeypot attack attempts
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity minor: Test: contained to one evaluation, no third party touched. The attempts are recorded only against Previdian's honeypot sensors, and the sources state no compromise of other parties' systems.
Langflow, an open-source platform for building AI applications and agentic workflows, has a critical authenticated remote code execution flaw (CVE-2026-105740) in versions before 1.9.0. According to an alert from Previdian, threat actors are exploiting it. The flaw lets any authenticated user add an MCP server whose command field is passed to a shell with no validation, allowlisting or sandboxing, so the command runs when the server list is fetched. Previdian's honeypot sensors recorded 1,423 exploitation attempts from 27 IP addresses since September 19, 2026. In one observed sequence, attackers authenticated with a common username and password. The Hacker News reported the activity on 2026-10-15, and an update raised the total to 1,706 attempts from 28 addresses. The sources do not state that any production system was compromised. Previdian recommended patching, disabling auto-login and enforcing strong passwords.
What happened
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
HarnessDid not exist Tool allow-list
Did not exist Sandboxed code execution
Did not exist Validation of tool inputs and outputs
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Vulnerability scanning of AI components, Adversarial testing before deployment, Short-lived, scoped credentials, Live behaviour monitoring, AI incident response plan, Segmentation of agent components, Encryption of stored data.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Intrusion and endpoint detection, Inventory of exposed services.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Tool allow-list | L2 Harness | Did not exist |
| Validation of tool inputs and outputs | L2 Harness | Did not exist |
| Sandboxed code execution | L2 Harness | Did not exist |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Segmentation of agent components | L3 Application | Not stated in sources |
| Live behaviour monitoring | L3 Application | Not stated in sources |
| AI incident response plan | L3 Application | Not stated in sources |
| Vulnerability scanning of AI components | L3 Application | Not stated in sources |
| Encryption of stored data | L3 Application | Not stated in sources |
| Adversarial testing before deployment | L3 Application | Not stated in sources |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Inventory of exposed services | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: what the AI was doing, what went wrong, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 3 items from the primary sources
What happened, in order
- 2026-09-19 Recorded exploitation attempts against honeypot sensors start from this date.
- 2026-10-11 Exploitation efforts ramp up; 333 attempts registered.
- 2026-10-15 66 attempts observed as of writing.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The sources describe exploitation attempts against honeypot sensors. No successful compromise of a production Langflow deployment is stated. Auto-login being disabled in the honeypot is a control that held, but no listed control id matches it, so it is not linked. The advisory is cited through press quotations, not a primary Langflow report. The remediation entry is advice from Previdian's CEO and is not a fix reported by a party that changed its own system. The update figures are a later addition to the same article.
LR-2026-0798 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON