Critical Authenticated RCE Flaw in Langflow AI Platform Actively Exploited by Threat Actors

A critical authenticated remote code execution (RCE) vulnerability, CVE-2026-105740 (CVSS score: 9.9), in the open-source AI application platform Langflow is being actively exploited by threat actors. The flaw affects versions prior to 1.9.0 and allows any authenticated user, including non-admin accounts, to execute arbitrary OS commands on the server, potentially leading to full server compromise. Exploitation attempts have been observed since September 19, 2026, with a significant increase starting October 11, 2026.