Act
active
Langflow Critical RCE CVE-2026-105740 Actively Exploited in the Wild
- Engineer — Act: Public PoC and 1,423 honeypot exploitation attempts confirm active in-the-wild attacks against Langflow (CVSS 9.9); if you run Langflow for AI workflow development, patch immediately or restrict access to authenticated users on trusted networks.
- SOC/IR — Act: Active exploitation campaign with over 1,400 observed attempts warrants an immediate sweep of internal and exposed Langflow instances for compromise indicators; hunt for unusual outbound connections or code execution from Langflow processes since the PoC became public.
- Leader — Plan: If your organization has AI/ML engineering teams building agentic workflows, confirm whether Langflow is in use and verify patching status — active exploitation is confirmed but the blast radius is limited to teams that have deployed this platform.
- Signals: CVE-2026-105740 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.