Detecting exploitation of CVE-2026-105740 in Langflow logs

A security writeup details how defenders can detect exploitation of CVE-2026-105740 in Langflow by correlating two requests: an HTTP POST to /api/v2/mcp/servers/{server_name} that stores a server entry containing a shell command, followed minutes later by a GET to /api/v2/mcp/servers?action_count=true. Honeypot telemetry recorded 1,423 attempts from 27 addresses between September 19 and mid-October 2026, with payloads harvesting LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and exfiltrating them to an external address on port 18764. Because the malicious command is persisted, the writeup recommends reading the stored MCP server list directly, upgrading to 1.9.0 or later, disabling auto-login, and rotating exposed secrets.

The exploit for CVE-2026-105740 leaves more traces than a typical command injection, because it spans two requests and writes configuration in between. A defender with request logs can look for the pattern. The first request writes a server entry: an HTTP POST to /api/v2/mcp/servers/{server name} . The second fetches the list: /api/v2/mcp/servers?action count=true . Either request alone can be legitimate traffic. The pair from one session, minutes apart, where the POST body contains a command field with shell syntax, is the signature. Fields worth extracting from the POST body include command , args and env . Look for shell metacharacters, a leading bash or sh invocation, curl or wget to an external address, and environment entries naming LD PRELOAD or a rewritten PATH . The capability requires a session. Previdian's record of the campaign shows the preparatory steps: a version check, an attempt against /api/v1/auto login , then a successful login with a common username and password. Authentication logs that show a first-seen IP logging in with an ordinary account shortly before MCP configuration calls are worth pulling in full. The captured payloads in the honeypot data reach for environment variables and application configuration, including LANGFLOW SECRET KEY and LANGFLOW SUPERUSER PASSWORD , and send them to an external address on port 18764. Docker commands attempting to read /etc/passwd appear alongside. One recurring source address in the telemetry is 192.255.229 . 92, which GreyNoise associates with brute-force activity and exploitation of Flowise CVE-2026-69255 plus several Langflow flaws. Following the stored command, an operator can expect to hold anything the Langflow process can reach: model provider keys, database credentials, and any internal service the container can route to. Because the command is persisted, log review alone is incomplete. Read the stored MCP server list and inspect every command value. A shell invocation there is a live backdoor even when the log window has passed and the version has already been patched. Honeypot attempts are not confirmed compromises of production systems. The volume, 1,423 attempts from 27 addresses between September 19 and mid October 2026, describes automated interest in the flaw. It does not establish that any particular Langflow deployment was entered. ZoomEye's app="Langflow" search returned 19,181 matching assets when checked; these are fingerprinted deployments rather than confirmed vulnerable hosts. The CVE filter vul.cve="CVE-2026-105740" returned 0 indexed assets at the same time. Upgrade to 1.9.0 or later, disable auto-login, and rotate any secret that was readable from an exposed instance.