Read the docs
TI-2026-68341 Aliases CVE-2026-105697GHSA-w794-rj3p-xv45

OS command injection in Langflow MCP stdio server configuration

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Langflow from 1.1.2 before 1.10.3, langflow-base from 0.1.2 before 0.10.3, and lfx before 1.10.3 are affected. The MCP stdio transport runs the configured command without validation, an OS command injection flaw (CWE-78). Any user who can edit MCP server settings or build a flow with the MCP Tools component can run OS commands as the Langflow process user. With the default auto-login setting, an attacker needs no account on an exposed instance.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTO_LOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00949 61st percentileScored 2026-11-07
Fix Fixed langflow (langflow-ai): 1.10.3langflow-base (langflow-ai): 0.10.3+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Langflowlangflow1.1.2 to before 1.10.31.10.3Patch availableCNA
Langflowlangflow-base0.1.2 to before 0.10.30.10.3Patch availableCNA
Langflowlfxbefore 1.10.31.10.3Patch availableCNA
—langflow (PyPI)1.1.2 to before 1.10.31.10.3Patch availableGHSA-w794-rj3p-xv45
—langflow-base (PyPI)0.1.2 to before 0.10.30.10.3Patch availableGHSA-w794-rj3p-xv45
—lfx (PyPI)before 1.10.31.10.3Patch availableGHSA-w794-rj3p-xv45
  • langflow VendorLangflow Affected 1.1.2 to before 1.10.3 Fixed in 1.10.3 Patch available CNA
  • langflow-base VendorLangflow Affected 0.1.2 to before 0.10.3 Fixed in 0.10.3 Patch available CNA
  • lfx VendorLangflow Affected before 1.10.3 Fixed in 1.10.3 Patch available CNA
  • langflow (PyPI) Vendor— Affected 1.1.2 to before 1.10.3 Fixed in 1.10.3 Patch available GHSA-w794-rj3p-xv45
  • langflow-base (PyPI) Vendor— Affected 0.1.2 to before 0.10.3 Fixed in 0.10.3 Patch available GHSA-w794-rj3p-xv45
  • lfx (PyPI) Vendor— Affected before 1.10.3 Fixed in 1.10.3 Patch available GHSA-w794-rj3p-xv45

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*——Langflow
  • cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* Versions — — ·Langflow

Remediation

Upgrade Langflow to 1.10.3, langflow-base to 0.10.3, and lfx to 1.10.3, which contain the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA langflow (langflow-ai) Fixed in 1.10.3
  • Fix · CNA langflow-base (langflow-ai) Fixed in 0.10.3
  • Fix · CNA lfx (langflow-ai) Fixed in 1.10.3
  • Fix · GHSA-w794-rj3p-xv45 langflow (PyPI) Fixed in 1.10.3 Advisory →
  • Fix · GHSA-w794-rj3p-xv45 langflow-base (PyPI) Fixed in 0.10.3 Advisory →
  • Fix · GHSA-w794-rj3p-xv45 lfx (PyPI) Fixed in 1.10.3 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105697
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-07 Alias added: GHSA-w794-rj3p-xv45
  4. 2026-10-07 Fix available: PyPI/[email protected], PyPI/[email protected], PyPI/[email protected] · GHSA-w794-rj3p-xv45
  5. 2026-10-07 CVSS score added · GHSA-w794-rj3p-xv45
  6. 2026-10-07 Weakness changed · GHSA-w794-rj3p-xv45
  7. 2026-10-07 8 new references · GHSA-w794-rj3p-xv45
  8. 2026-10-09 3 new references · GHSA-w794-rj3p-xv45
  9. 2026-10-10 3 new references · CNA
  10. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 10

  • TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-00553 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… KEVCVSS 3.0CRITICAL 9.8
  • TI-2025-24427 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE KEVCVSS 4.0CRITICAL 9.4
  • TI-2025-02845 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-25463 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-39928 Authorization bypass in langflow KEVCVSS 3.1HIGH 8.4
See all 236 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences