EventCybersecurityOctober 15, 2026

Langflow RCE flaw CVE-2026-105740 targeted in 1,423 honeypot attempts

Read original source →thehackernews.com

The authenticated RCE (CVSS 9.9) affects Langflow versions before 1.9.0; any logged-in user, including non-admins, can run OS commands by adding an MCP server with stdio transport. The command field passes unvalidated to bash -c, and the env field allows LD_PRELOAD or PATH injection.

1 source

More stories today

Open the live feed