CVE-2026-105697: Langflow OS command injection via MCP stdio server configuration (< 1.10.3)
- Product
- langflow (PyPI)
- CVE
- CVE-2026-105697
- Affected
- >= 1.1.2, < 1.10.3
- Fixed in
- 1.10.3
Last verified against sources: October 16, 2026
Am I affected?
langflow (PyPI): affected >= 1.1.2, < 1.10.3. Fixed in 1.10.3.
What to do now
- Upgrade langflow to 1.10.3 or later and disable LANGFLOW_AUTO_LOGIN on exposed instances. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- According to GitHub Advisory Database's advisory (Oct 7, 2026), before Langflow 1.10.3, the MCP stdio transport launched whatever command and args a user put in an MCP server configuration with no allowlist. [1]
Impact
- Any user able to reach MCP server settings or build a flow with the MCP Tools component could run arbitrary OS commands on the Langflow host as the Langflow process user (CVSS 9.9). [1]
What was done
- Fixed in Langflow 1.10.3 by applying command allowlist and argument validation at the execution sink. [1]
Sources
- GHSA-w794-rj3p-xv45 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-105697] CVE-2026-105697: Langflow OS command injection via MCP stdio server configuration (< 1.10.3)
Product: langflow (PyPI) | Affected: >= 1.1.2, < 1.10.3 | Fixed in: 1.10.3
Summary: According to GitHub Advisory Database's advisory (Oct 7, 2026), before Langflow 1.10.3, the MCP stdio transport launched whatever command and args a user put in an MCP server configuration with no allowlist.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-105697-langflow-mcp-stdio-command-injectionCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-105697
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.