# Detecting exploitation of CVE-2026-105740 in Langflow logs

> Source: <https://dev.to/ioneyrezende/detecting-exploitation-of-cve-2026-105740-in-langflow-logs-1f2b>
> Published: 2026-10-28 10:01:38+00:00

The exploit for CVE-2026-105740 leaves more traces than a typical command injection, because it spans two requests and writes configuration in between. A defender with request logs can look for the pattern.

The first request writes a server entry: an HTTP POST to `/api/v2/mcp/servers/{server_name}`. The second fetches the list: `/api/v2/mcp/servers?action_count=true`. Either request alone can be legitimate traffic. The pair from one session, minutes apart, where the POST body contains a `command` field with shell syntax, is the signature.

Fields worth extracting from the POST body include `command`, `args` and `env`. Look for shell metacharacters, a leading `bash` or `sh` invocation, `curl` or `wget` to an external address, and environment entries naming `LD_PRELOAD` or a rewritten `PATH`.

The capability requires a session. Previdian's record of the campaign shows the preparatory steps: a version check, an attempt against `/api/v1/auto_login`, then a successful login with a common username and password. Authentication logs that show a first-seen IP logging in with an ordinary account shortly before MCP configuration calls are worth pulling in full.

The captured payloads in the honeypot data reach for environment variables and application configuration, including `LANGFLOW_SECRET_KEY` and `LANGFLOW_SUPERUSER_PASSWORD`, and send them to an external address on port 18764. Docker commands attempting to read `/etc/passwd` appear alongside. One recurring source address in the telemetry is 192.255.229[.]92, which GreyNoise associates with brute-force activity and exploitation of Flowise CVE-2026-69255 plus several Langflow flaws.

Following the stored command, an operator can expect to hold anything the Langflow process can reach: model provider keys, database credentials, and any internal service the container can route to.

Because the command is persisted, log review alone is incomplete. Read the stored MCP server list and inspect every command value. A shell invocation there is a live backdoor even when the log window has passed and the version has already been patched.

Honeypot attempts are not confirmed compromises of production systems. The volume, 1,423 attempts from 27 addresses between September 19 and mid October 2026, describes automated interest in the flaw. It does not establish that any particular Langflow deployment was entered.

ZoomEye's `app="Langflow"` search returned 19,181 matching assets when checked; these are fingerprinted deployments rather than confirmed vulnerable hosts. The CVE filter `vul.cve="CVE-2026-105740"` returned 0 indexed assets at the same time. Upgrade to 1.9.0 or later, disable auto-login, and rotate any secret that was readable from an exposed instance.