CVE-2026-105740 Langflow RCE sees 1423 honeypot hits after DataStax-IBM deal

The flaw lets any authenticated account POST a malicious command to /api/v2/mcp/servers/{name} that executes on subsequent GET list fetches. No allowlist, sandbox, or visibility in the flow editor means the payload persists in project settings and re-runs on every enumeration. Previdian honeypots logged the first spike on 11 October with 333 attempts in one day; GreyNoise ties the dominant IP 192.255.229.92 to prior brute-force campaigns against exposed AI tooling.

Langflow's February 2025 acquisition by IBM via DataStax did not alter default authentication or add command validation. Similar unaudited execution paths have appeared in LangChain agent sandboxes and AutoGen workflows, where user-supplied transport strings reach the host shell. Procurement records show government and enterprise pilots continue to deploy these projects without additional hardening layers.

Attackers first probe /api/v1/auto_login, then fall back to common credentials before using the bearer token on the MCP endpoint. Captured payloads target LANGFLOW_SECRET_KEY and attempt LD_PRELOAD or Docker host escapes. The pattern matches post-acquisition neglect seen in other open-source AI stacks where marketing outpaces security reviews.

Unpatched instances remain reachable on the public internet. Expect continued scanning until 1.9.0 adoption exceeds 60 percent or until a follow-on CVE forces broader patching.