Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Honeypots recorded 1,423 attempts exploiting Langflow's critical authenticated RCE, CVE-2026-105740.
78
Vendor
Langflow
- Mentions · 7d0
- Mentions · 30d1
- All mentions10
- First seenAug 24, 2026
- Last mentioned15d ago
Timeline
10 articles · newest firstAI Agents Now Run Ransomware Attacks End-to-End Without Human Operators
SOCRadar documented JADEPUFFER, an AI agent that autonomously executed a ransomware campaign from Langflow exploit through encryption and extortion.
80
JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data
Sysdig links JADEPUFFER, an AI-driven ransomware actor, to ENCFORGE, a new locker encrypting and destroying AI models, training data, and vector databases.
76
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
48
Langflow Remote Code Execution Vulnerability Exploited in Attacks (CVE-2026-0768)
Critical CVSS 9.8 RCE CVE-2026-0768 in Langflow is under active exploitation, with attackers probing for credentials and secrets.
65
Hackers Target Langflow in CVE-2026
Threat actors are actively exploiting CVE-2026-0768, an unauthenticated Python RCE in Langflow, hunting OpenAI, AWS, and SSH credentials.
72
[webapps] Langflow 1.10.0 - RCE
A public proof-of-concept demonstrates remote code execution in Langflow 1.10.0, the open-source AI workflow builder.
32
Attackers Exploit Critical Langflow and Rails Flaws in Credential
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
88
[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution
A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.
42
CVE-2026-0770: Langflow exec_globals RCE Vulnerability
CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in Langflow's exec_globals, endangering exposed deployments.
58
Related CVEs
by mentions- CVE-2026-07682%9.8Langflow code Code Injection Remote Code Execution Vulnerability
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2026-55255<1%8.4IDOR Authorization Bypass in Langflow Lets Attackers Run Other Users' Flows
- CVE-2026-502736%8.8Authenticated Path Traversal Arbitrary File Write in Langflow Files API
- CVE-2026-077063%9.8Unauthenticated Remote Code Execution in Langflow validate Endpoint
- CVE-2026-3301796%9.3Unauthenticated RCE in Langflow AI Workflow Builder
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- Langflow: The MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before…
- Langflow: Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio"…
- CVE-2025-5498815%8.4Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML…
Appears with
- Langflowproduct · 8
- CISAorganization · 2
- JADEPUFFERthreat actor · 2
- VulnCheckorganization · 2
- SOCRadarorganization · 2
- VulnCheckvendor · 2
- Trend Microvendor · 2
- PaperCut NG/MFproduct · 1
- GreyNoiseorganization · 1
- SonicWallvendor · 1
- Ruby on Railsvendor · 1
- Lynxthreat actor · 1
- DataStaxorganization · 1
- Unknownthreat actor · 1
- IBMorganization · 1
- Cisco Secure Firewall Management Centerproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.