On Langflow servers before 1.9.0 (or before 1.10.3), review web/proxy logs for POST /api/v2/mcp/servers/<name> from non-admin users and for repeated GET /api/v2/mcp/servers?action_count=true. On the host, look for the Langflow process spawning bash -c "exec ..." with unusual children (curl/wget, /dev/tcp reverse shells, miners), and for MCP server configs with an env block setting LD_PRELOAD or PATH. Export the stored MCP server list per project and delete anything you didn't create. Also check whether LANGFLOW_AUTO_LOGIN is enabled or self-registration is open, since any authenticated account is enough. Rotate credentials in the Langflow environment (LLM keys, database URLs, cloud metadata access) if anything turns up.