Langflow CVE-2026-105740 exploitation leaves a two-request pattern defenders can detect

A write-up on dev.to lays out a practical detection playbook for CVE-2026-105740, a command injection flaw in Langflow that is being actively probed in the wild. Because the exploit spans two HTTP requests and writes configuration in between, it leaves a more recognizable trail in request logs than a typical injection.

The two-request signature

The pattern to hunt for, according to the dev.to analysis, is a pair of calls to Langflow's MCP configuration API. The first is a POST to /api/v2/mcp/servers/{server_name}, which writes a server entry. The second is a request to /api/v2/mcp/servers?action_count=true, which fetches the list. Either request on its own can be perfectly legitimate traffic; the telling combination is the pair arriving from one session minutes apart, with the POST body carrying a command field containing shell syntax.

What to pull from the request body

The fields worth extracting for analysis are command, args and env. The write-up lists specific red flags: shell metacharacters, an invocation beginning with bash or sh, a curl or wget call out to an external address, and environment entries that set LD_PRELOAD or rewrite PATH.

The authentication trail

The capability requires an authenticated session. Citing telemetry recorded by Previdian, the article describes the preparatory sequence observed in the campaign: a version check, an attempt against /api/v1/auto_login, and then a successful login using a common username and password. The recommended hunt is authentication logs showing a previously unseen IP address signing into an everyday account shortly before MCP configuration calls, and pulling those sessions in full.

Post-exploitation indicators

Captured honeypot payloads, per the analysis, go after environment variables and application configuration — specifically LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD — and exfiltrate them to an external address on port 18764. Docker commands attempting to read /etc/passwd appear alongside. One recurring source address in the telemetry is 192.255.229[.]92, which GreyNoise ties to brute-force activity and to exploitation of Flowise CVE-2026-69255 along with several other Langflow flaws. An attacker who gets the stored command running holds everything the Langflow process can reach: API keys for model providers, database credentials, and any internal service the container can route to.

The command outlives the log window

A key point of the write-up is that the injected command is persisted in the MCP server configuration, so log review alone is incomplete. Defenders should read the stored MCP server list and inspect every command value. A shell invocation sitting in that list is an active backdoor even after the relevant logs have rotated out and the instance has been upgraded.

How much scanning is actually happening

The article is careful about what the numbers do and do not mean. Honeypot attempts are not confirmed compromises. The telemetry counts 1,423 attempts from 27 addresses between September 19 and mid-October 2026 — evidence of automated interest in the flaw, not proof that any particular Langflow deployment was breached. For exposure context, a ZoomEye search for app="Langflow" returned 19,181 fingerprinted deployments at the time of checking, while the CVE-specific filter vul.cve="CVE-2026-105740" returned zero indexed assets.

Patching and rotation

The recommended remediation, per the write-up, is to upgrade to Langflow 1.9.0 or later, disable auto-login, and rotate any secret that was readable from an exposed instance.

Why it matters

Command injection flaws in developer tooling are often deprioritized when they require authentication, but this telemetry shows attackers chaining a trivial credential login straight into command execution and secret theft. The detection guidance is also cheap to act on: the request pair is highly specific, the authentication pattern narrows the search, and the persisted-command check catches intrusions that log retention has already lost. Any Langflow instance that was exposed during the September-to-October window is a candidate for review even if it has since been patched.