2026-01-23 · 2026-Q1
Langflow Active Exploitation Deploys Flodrix Botnet
PrimaryL6Identity / RunSecondaryL5Config
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- Yes
- Actor:
- Attacker
Target
Langflow (versions up to 1.6.9)
Impact
Complete account takeover and RCE via malicious webpage visit; Flodrix botnet deployed for DDoS and data exfiltration
Root Cause
Overly permissive CORS, no CSRF protection on token refresh, code validation endpoint allows execution