2026-01-23 · 2026-Q1

Langflow Active Exploitation Deploys Flodrix Botnet

Primary layerL6 Identity / RunSecondary:L5 Config

Which agent, run, or tenant is this?
The question layer 6 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: Yes
Actor: Attacker

Target

Langflow (versions up to 1.6.9)

Impact

Complete account takeover and RCE via malicious webpage visit; Flodrix botnet deployed for DDoS and data exfiltration

Root cause

Overly permissive CORS, no CSRF protection on token refresh, code validation endpoint allows execution

CVE

CVE-2025-34291

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Langflow Active Exploitation Deploys Flodrix Botnet (2026-01-23). https://agentprov.com/incidents/2026-01-23-langflow-active-exploitation-deploys-flodrix-botnet

Same event · 2025-10Langflow Account Takeover and RCE ChainL6Identity / Run
Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run