{"slug": "reconstructing-an-attack-timeline-for-langflow-cve-2026-105740", "title": "Reconstructing an attack timeline for Langflow CVE-2026-105740", "summary": "A security analysis of CVE-2026-105740 in Langflow, patched in version 1.9.0, details how an authenticated non-admin user can store a command in an MCP server setting that later executes via `bash -c \"exec {command}\"` when the server list is loaded. The writeup maps the attack chain from the `POST /api/v2/mcp/servers/{server_name}` configuration write to the triggering `GET /api/v2/mcp/servers?action_count=true` request and the resulting child processes, and recommends hunting for credential theft, reverse shells and data exfiltration. It cites Previdian's 1,423 exploitation attempts recorded from September 19 to October 15, 2026, and a ZoomEye tally of 19,181 Langflow-fingerprinted assets, while cautioning that neither figure counts production victims.", "body_md": "A Langflow compromise can leave an unusual evidence trail because the exploit separates configuration from execution. CVE-2026-105740 affects versions before 1.9.0. An authenticated user stores a command through an MCP server setting. Later, loading the server list starts `bash -c \"exec {command}\"`. Investigators need to connect those events, then find which credentials and internal services the child process reached.\n\nFind successful and failed logins around the incident window. Pay attention to ordinary user accounts because the advisory states that the route did not require an administrator. TheHackerNews described a honeypot sequence that checked `/api/v1/auto_login`, received 403 and then authenticated with a common username and password.\n\nThe configuration write appears as `POST /api/v2/mcp/servers/{server_name}`. Capture the user, token, source address, time, request body and project. Search for other writes by the same identity, including changes to users, tokens or project membership.\n\nThe list request `GET /api/v2/mcp/servers?action_count=true` triggers the stored command according to the advisory. A normal administrative request can look identical, so compare it with process activity that follows within a short interval.\n\nReview process trees with Langflow as the ancestor. Look for bash, shells, download utilities, reverse-shell clients and interpretable commands. Save command lines and environment data where policy allows. The `env` configuration can change `PATH` or inject `LD_PRELOAD`, which affects how the next process resolves binaries and libraries.\n\nMap network flows to those process times. A short callback can precede credential theft and a longer transfer. TheHackerNews reported honeypot payloads that sought `LANGFLOW_SECRET_KEY` and `LANGFLOW_SUPERUSER_PASSWORD`, ran Docker commands and read `/etc/passwd`. Those examples guide searches, but each production timeline needs its own evidence.\n\nThe MCP configuration is both the trigger and a source of attribution. Its command, environment, owner and project link to the account that created it. It can persist after the request and run again on later list loads. Export the record and its related database rows before removal.\n\nA fixed application image without a clean configuration is not a complete recovery. Patch to 1.9.0, remove unapproved entries and verify the MCP inventory. Preserve a hash of the exported evidence and a manifest of approved definitions.\n\nThe Langflow process may hold model, database, source-control and internal-service credentials. Identify every secret available at the execution time. Search those providers and services for use from unusual addresses, clients or times. Rotate the secrets that the process could read.\n\nReview internal service authentication, cloud audit logs, database sessions and CI tokens. A reverse shell is only one possible outcome. A stored command that copies a configuration or calls an approved API can look less dramatic in process telemetry while still moving data.\n\nThe exploitation telemetry is useful when its limits are clear. Previdian recorded 1,423 attempts from September 19 through October 15, 2026. Those events came from sensors and do not identify a production victim. ZoomEye returned 19,181 assets for `app=\"Langflow\"` on October 28, 2026. That is a product-fingerprint tally, not a count of vulnerable instances.\n\nIn the incident report, label the vulnerability facts, the observed request chain, the process evidence and the credential evidence separately. A missing log entry has a retention or collection explanation before it becomes proof that nothing happened.\n\nRequire review for MCP commands and environment keys. Alert on command-bearing configuration changes, unexpected child processes and new egress destinations. Keep the service account and secrets narrow. These controls lower the chance that a future configuration mistake becomes a server takeover.", "url": "https://wpnews.pro/news/reconstructing-an-attack-timeline-for-langflow-cve-2026-105740", "canonical_source": "https://dev.to/bianliang/reconstructing-an-attack-timeline-for-langflow-cve-2026-105740-5fbg", "published_at": "2026-10-28 15:40:53+00:00", "updated_at": "2026-10-28 15:41:14.768303+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "agent-protocols"], "entities": ["Langflow", "Previdian", "ZoomEye", "TheHackerNews", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/reconstructing-an-attack-timeline-for-langflow-cve-2026-105740", "markdown": "https://wpnews.pro/news/reconstructing-an-attack-timeline-for-langflow-cve-2026-105740.md", "text": "https://wpnews.pro/news/reconstructing-an-attack-timeline-for-langflow-cve-2026-105740.txt", "jsonld": "https://wpnews.pro/news/reconstructing-an-attack-timeline-for-langflow-cve-2026-105740.jsonld"}}