如何從 Langflow 日誌偵測 CVE-2026-105740 的利用行為

Detecting exploitation of CVE-2026-105740 in Langflow logs

The exploit for CVE-2026-105740 leaves more traces than a typical command injection, because it spans two requests and writes configuration in between. A defender with request logs can look for the pattern.

The request pair to search for

The first request writes a server entry: an HTTP POST to /api/v2/mcp/servers/{server_name}. The second fetches the list: /api/v2/mcp/servers?action_count=true. Either request alone can be legitimate traffic. The pair from one session, minutes apart, where the POST body contains a command field with shell syntax, is the signature.
Fields worth extracting from the POST body include command, args and env. Look for shell metacharacters, a leading bash or sh invocation, curl or wget to an external address, and environment entries naming LD_PRELOAD or a rewritten PATH.

Authentication context

The capability requires a session. Previdian's record of the campaign shows the preparatory steps: a version check, an attempt against /api/v1/auto_login, then a successful login with a common username and password. Authentication logs that show a first-seen IP logging in with an ordinary account shortly before MCP configuration calls are worth pulling in full.

Post-exploitation signals

The captured payloads in the honeypot data reach for environment variables and application configuration, including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD, and send them to an external address on port 18764. Docker commands attempting to read /etc/passwd appear alongside. One recurring source address in the telemetry is 192.255.229[.]92, which GreyNoise associates with brute-force activity and exploitation of Flowise CVE-2026-69255 plus several Langflow flaws.
Following the stored command, an operator can expect to hold anything the Langflow process can reach: model provider keys, database credentials, and any internal service the container can route to.

Configuration review

Because the command is persisted, log review alone is incomplete. Read the stored MCP server list and inspect every command value. A shell invocation there is a live backdoor even when the log window has passed and the version has already been patched.

What the record cannot tell you

Honeypot attempts are not confirmed compromises of production systems. The volume, 1,423 attempts from 27 addresses between September 19 and mid October 2026, describes automated interest in the flaw. It does not establish that any particular Langflow deployment was entered.

Exposure context and fix

ZoomEye's app="Langflow" search returned 19,181 matching assets when checked; these are fingerprinted deployments rather than confirmed vulnerable hosts. The CVE filter vul.cve="CVE-2026-105740" returned 0 indexed assets at the same time. Upgrade to 1.9.0 or later, disable auto-login, and rotate any secret that was readable from an exposed instance.