Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
- Product
- Langflow
- CVE
- CVE-2026-105697
- Affected
- langflow >= 1.1.2, < 1.10.3; langflow-base >= 0.1.2, < 0.10.3; lfx < 1.10.3
- Fixed in
- 1.10.3 (langflow, lfx); 0.10.3 (langflow-base)
Last verified against sources: October 26, 2026
Am I affected?
Langflow: affected langflow >= 1.1.2, < 1.10.3; langflow-base >= 0.1.2, < 0.10.3; lfx < 1.10.3. Fixed in 1.10.3 (langflow, lfx); 0.10.3 (langflow-base).
- Check your version: run
pip show langflow. Versions >= 1.1.2, < 1.10.3 of langflow are affected. [1] - Check your version: run
pip show langflow-base. Versions >= 0.1.2, < 0.10.3 of langflow-base are affected. [1] - Check your version: run
pip show lfx. Versions < 1.10.3 of lfx are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "langflow>=1.10.3"(first patched version 1.10.3). [1] - Upgrade to the fixed version: run
pip install --upgrade "langflow-base>=0.10.3"(first patched version 0.10.3). [1] - Upgrade to the fixed version: run
pip install --upgrade "lfx>=1.10.3"(first patched version 1.10.3). [1] - Upgrade to Langflow 1.10.3 (langflow-base 0.10.3, lfx 1.10.3). [1]
- If you cannot upgrade, set
LANGFLOW_AUTO_LOGIN=falseand do not expose Langflow directly to untrusted networks. [1] - Only give Langflow accounts to trusted users. [1]
- On multi-tenant deployments, set
LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES,LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=trueandLANGFLOW_MCP_SERVER_DOCKER_HARDENING=true. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- Before Langflow 1.10.3, the MCP stdio transport ran any command a user typed into an MCP server configuration, with no allowlist. [1]
- Before 1.10.3 the command was wrapped in
bash -c "exec {command} ...". [1] - The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server, even when the UI then reports that the stdio server failed to start. [1]
- With the default
LANGFLOW_AUTO_LOGIN=true,GET /api/v1/auto_loginhands out a token without credentials. [1]
Impact
- An attacker could run any operating system command on the Langflow host as the Langflow process user (remote code execution, CWE-78). [1]
- Any exposed instance on a vulnerable version is affected, whether the attacker has an account or uses the default
AUTO_LOGIN. [1] - The reporter found several internet-facing Langflow servers that were vulnerable. [1]
What was done
- In 1.9.0, change #12290 added a command allowlist and argument and environment validation to the REST model
MCPServerConfig, blocking the "Add MCP Server" path. [1] - In 1.10.3, change #14036 applied the same policy at the execution sink
lfx.base.mcp.util, including configs embedded in flows or tweaks and just before the process is spawned, and removed thebash -cwrapper. [1] - In 1.11.0, change #13530 adds optional stricter modes for multi-tenant deployments. [1]
Sources
- GHSA-w794-rj3p-xv45 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-105697] Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Product: Langflow | Affected: langflow >= 1.1.2, < 1.10.3; langflow-base >= 0.1.2, < 0.10.3; lfx < 1.10.3 | Fixed in: 1.10.3 (langflow, lfx); 0.10.3 (langflow-base)
Summary: Before Langflow 1.10.3, the MCP stdio transport ran any command a user typed into an MCP server configuration, with no allowlist.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-105697-langflowCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-105697
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.