EventCybersecurityOctober 15, 2026

Langflow RCE flaw CVE-2026-105740 hit by 1,423 honeypot exploit attempts

Read original source →thehackernews.com

CVE-2026-105740 (CVSS 9.9) lets any authenticated Langflow user, including non-admins, run OS commands by adding an MCP server with 'stdio' transport; versions before 1.9.0 are affected. The command field is passed to bash -c with no validation, allowlisting, or sandboxing.

1 source

More stories today

Open the live feed