Exploited Before It Was Published: CVE-2026-105740 and Sixteen Days of Pre-Disclosure Langflow Attacks

This site briefed CVE-2026-105740 as a vulnerability: an authenticated Langflow user turning an MCP stdio server entry into arbitrary OS commands, CVSS 9.9, fixed in 1.9.0. This briefing is the follow-up the record now demands, because the vulnerability has become a campaign. Previdian marks the CVE as exploited with confirmed confidence, its sensors having recorded the first attempts on 19 September 2026 — sixteen days before NVD published the record on 5 October. As of 16 October the counters read 1,966 attempts from 28 attacker IPs across 16 countries, and the CVE is still absent from CISA KEV. Attackers were working this flaw while it was still a private advisory.

The numbers moved even during this story’s own short shelf life: The Hacker News, reporting Previdian’s alert on 15 October, cited 1,423 attempts from 27 IPs; the vendor’s live page now shows 1,966 from 28. The daily telemetry explains the jump — activity ramped from 11 October with 333 attempts, then sustained triple-digit days (327, 323, 259, 316, 293) into mid-October. Whatever the exact count on the day you read this, the shape is established: a slow September burn that became an October harvest.

How the attackers get past “authenticated”

The CVE’s PR:L rating has always been the load-bearing qualifier, and the observed attack sequence shows exactly how little load it bears. Previdian founder and CEO Ryan Dewhurst told The Hacker News that in one captured sequence the attackers checked the Langflow version first, then tried /api/v1/auto_login — which returned 403 because the honeypot had it disabled — and then successfully authenticated with credentials, immediately spending the resulting bearer token on the MCP server configuration endpoint. When auto-login is left on, the first step is unnecessary; when it is off, weak or default credentials do the job. The remediation guidance that follows the report reads like a confession of the entry path: upgrade, disable auto-login, enforce strong and unique passwords, and review authentication logs.

The detonation itself is worth restating precisely because it is quiet. The attacker’s command is stored without validation when the MCP server is created, and it executes when the server list is fetched — a plain HTTP GET to /api/v2/mcp/servers?action_count=true. Worse, the malicious configuration persists and re-executes every time the list loads, and Langflow itself warns that MCP server configs live in project settings, invisible during normal flow review. Unlike custom component code, which a reviewer can see in the flow editor, this backdoor hides in settings. One write, unlimited executions, no visible artifact in the canvas the team actually reviews.

What the payloads take

Captured payloads show an operation interested in secrets first and footholds second. Attempts extracted environment variables and Langflow configuration — explicitly including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD — and transmitted them to 146.70.211[.]112:18764. Alongside the exfiltration ran the standard lattice of post-exploitation probes: Docker commands reaching for the host filesystem and /etc/passwd, plus id and whoami execution checks. A service that holds model keys, provider credentials, and flow logic is being treated, correctly from the attacker’s perspective, as a credential store that happens to serve an API.

One address ties the campaign together. A significant share of the activity originates from 192.255.229[.]92, observed attempting environment-variable extraction, and combined GreyNoise and Previdian data places that IP across generic brute-force attacks plus exploitation of Flowise’s CVE-2026-69255 and three more Langflow flaws: CVE-2026-55255, CVE-2026-9198, and CVE-2026-0768. That last identifier should ring a bell here — this site briefed CVE-2026-0768 as a code-validator RCE that was still harvesting credentials in October months after its January patch. The same infrastructure working the January flaw, the September stdio flaw, and a Flowise flaw is not opportunism; it is an actor, or a toolset, systematically farming exposed AI-builder instances. Dewhurst is quoted as saying the end goals are currently unclear. The credential-first payload mix suggests the goals are fungible: keys, compute, and persistence, in whatever order the instance offers them.

Three gaps the telemetry exposes

First, the disclosure gap. Sixteen days of sensor-observed exploitation preceded publication. Patch-first, advisory-later workflows compress defenders’ reaction time to zero for anyone waiting on a CVE feed — and Langflow’s own record this year (the 25-flaw batch, the validator RCE, the sibling 9.9 in CVE-2026-105697) suggests the project’s flaws arrive in clusters that reward watching the repository, not the database.

Second, the scoring gap. EPSS puts the 30-day exploitation probability at 0.6%. Confirmed exploitation is at 100%. This is not a novel observation — EPSS is a population prior, not a sensor — but the juxtaposition on a single vendor page (0.6% beside “Confirmed”) is the cleanest real-world exhibit of why prioritization pipelines keyed to predicted probability keep missing the vulnerabilities attackers actually chose. The page’s own copy concedes the point: its warning comes from evidence, not the score.

Third, the catalog gap. The CVE is not in CISA KEV, and Previdian records no scanner integrations for it yet. Between the honeypot and the catalog sits the exact population this site writes for: operators who patch from KEV-driven queues and therefore have not been told. Previdian, to state the vendor interest plainly, sells itself as the early-warning layer above the KEV baseline — which is both a marketing claim and, on the evidence of the September telemetry, a fair description of what happened here.

Related reading on this site: the original 105697/105740 briefing for the sink mechanics and the two-fixed-versions wrinkle, and the CVE-2026-0768 harvesting briefing for the older flaw the same attacker infrastructure is still working.

What to do

Patch to 1.9.0 or later and treat every earlier instance as potentially seeded. Because the malicious server entry persists and re-executes on list loads, upgrading the binary without auditing stored MCP configurations leaves the backdoor in place. Enumerate configured MCP servers on every pre-1.9.0 instance and treat unknown stdio entries — especially ones with commands you did not author — as compromise until proven otherwise.

Set LANGFLOW_AUTO_LOGIN=false, enforce unique strong passwords, and stop exposing Langflow to untrusted networks. The observed authentication path walked straight through the front door. If immediate patching is impossible, restrict accounts to trusted users only.

Hunt with the telemetry, not the score. Review authentication logs and requests to /api/v2/mcp/servers/ for version-check-then-login sequences; watch for outbound connections to unknown high ports carrying configuration material; and block or alert on the published indicators (192.255.229[.]92, exfiltration to 146.70.211[.]112:18764) while noting that infrastructure rotates. An EPSS of 0.6% next to confirmed exploitation is the signal to recalibrate, not to relax.

Sourcing: CVE fields, CVSS 9.9 vector, and NVD publication data read first-hand from the NVD 2.0 API; sensor counts, first/last-observed dates, country and IP tallies, daily volumes, EPSS, KEV absence, and timeline entries read first-hand from Previdian’s live CVE-2026-105740 page on 16 October 2026; attack sequence, payload contents, exfiltration destination, attacker-IP attribution, GreyNoise corroboration, and remediation quotes read first-hand from the syndicated mirror of The Hacker News reporting (the original is JS-walled from the build host), attributed as press reporting rather than primary telemetry. Brave Search used for discovery only. Nothing deployed, no Langflow instance contacted, no payload executed, no third-party request sent beyond reading the cited public records.