Is CVE-2026-105740 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-105740

Users of Langflow should immediately check for and apply the latest security updates provided by Langflow/DataStax. Prioritize updating to the patched version to address the RCE vulnerability. Review and strengthen authentication controls to prevent unauthorized access. Consult official security advisories from Langflow and IBM for detailed guidance on patching and mitigation. Monitor systems for suspicious activity following the disclosure.

Quick answers

What is CVE-2026-105740?: Users of Langflow should immediately check for and apply the latest security updates provided by Langflow/DataStax. Prioritize updating to the patched version to address the RCE vulnerability. Review and strengthen authentication controls to prevent unauthorized access. Consult official security advisories from Langflow and IBM for detailed guidance on patching and mitigation. Monitor systems for suspicious activity following the disclosure.
How severe is CVE-2026-105740?: critical, CVSS 9.9
Is CVE-2026-105740 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-105740 be mitigated?: Users of Langflow should immediately check for and apply the latest security updates provided by Langflow/DataStax. Prioritize updating to the patched version to address the RCE vulnerability. Review and strengthen authentication controls to prevent unauthorized access. Consult official security advisories from Langflow and IBM for detailed guidance on patching and mitigation. Monitor systems for suspicious activity following the disclosure.

CVSS

9.9

Vendor

DataStax

Published

Oct 18, 2026 · 03:48

Patch

Unknown / not confirmed

Affected products

Langflow

Mitigation

Active Exploitation of Langflow Authenticated RCE Vulnerability Observed in Honeypot Monitoring

According to security alerts and honeypot data, a critical authenticated remote code execution vulnerability in Langflow (CVE-2026-105740, CVSS 9.9) is being actively exploited in the wild. Security researchers have recorded 1,423 exploit attempts targeting Langflow deployments globally. The vulnerability allows attackers with authentication privileges to execute arbitrary code on affected systems, potentially leading to full compromise of AI workflows and associated data. The parent company DataStax was acquired by IBM in February 2025. Users are strongly advised to apply available patches and monitor official advisories for mitigation guidance.

41m

CVE-2026-105740

Quick answers

Related News

Active Exploitation of Langflow Authenticated RCE Vulnerability Observed in Honeypot Monitoring