CVE-2026-105697

Langflow MCP execution paths accept tenant-controlled host commands

langflow-ai · Langflow MCP stdio transport

First documented disclosure · Review checkpoint

Summary

MCP server settings and embedded flow configurations can launch unauthorized commands as the Langflow service account.

Severity and exploitation evidence

Critical · 9.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources establish a vulnerability and controlled reproduction, not real-world malicious exploitation. CISA KEV 2026.10.27 contains no exact-ID match; absence is not proof of no exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unrestricted stdio commands and a shell wrapper allowed execution before MCP startup; an API-only fix left flow/tweak and final-spawn paths exposed.

Conditions required

Access to MCP configuration or an executable flow; default development AUTO_LOGIN can provide a token without credentials, while hardened login requires an authenticated non-admin user.

Potential impact

Host command execution with the Langflow process’s access to secrets, files and connected services.

Affected versions and configurations

Langflow >=1.1.2,<1.10.3; langflow-base >=0.1.2,<0.10.3; lfx <1.10.3.

Fix and mitigation status

Langflow/lfx 1.10.3 and langflow-base 0.10.3. Version 1.9.0 fixes only the REST settings path.

Practical next steps

Upgrade all relevant packages; disable AUTO_LOGIN, restrict users and executable packages, and apply documented interpreter/Docker hardening.

Operating lesson

Validate executable connector configuration again where the process is launched.

Evidence and limits

March23 public REST-fix PR precedes July13 broader execution-fix PR, September28 advisory and October5 CVE. It overlaps the REST vector in105740 but has a separate CVE and broader fix boundary; 105740 sensor attempts are not automatically evidence for this ID.

Sources