Langflow auto-login removes the last barrier to CVE-2026-105740

Previdian researchers showed that leaving LANGFLOW_AUTO_LOGIN enabled lets attackers obtain a session without credentials and reach CVE-2026-105740. In a honeypot, the operator got a 403 on /api/v1/auto_login but logged in with a common username and password. ZoomEye counted 19,181 fingerprinted Langflow deployments.

• LANGFLOW_AUTO_LOGIN=false blocks credential-free sessions
• Honeypot login succeeded with a common username and password
• ZoomEye: 19,181 assets match app="Langflow"
• Rotate LANGFLOW_SECRET_KEY and the superuser password after exposure