CVE-2026-105697

Received Received - Intake

Command Injection in Langflow AI Agent Framework

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTO_LOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105697

Affected Vendors & Products

Vendor	Product	Version / Range
langflow-ai	langflow	>= 1.1.2, < 1.10.3
langflow-ai	langflow-base	>= 0.1.2, < 0.10.3
langflow-ai	lfx	< 1.10.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Langflow before version 1.10.3 has a command injection vulnerability in its MCP stdio transport. Users with access to MCP server settings or the MCP Tools component could inject arbitrary OS commands into the server configuration. These commands would execute on the Langflow host as the process user when Langflow attempts to connect to the server, even if the UI reports a failure.

Detection Guidance

Check Langflow version with: curl -s http://<langflow-server>/api/v1/version | grep version. If version is below 1.10.3, the system is vulnerable. Inspect MCP server configurations via GET /api/v2/mcp/servers/{server_name} for suspicious commands.

Impact Analysis

An attacker could execute any OS command on the Langflow host, such as deleting files, creating backdoors, or launching reverse shells. This could lead to full system compromise, data theft, or disruption of services. The impact depends on the permissions of the Langflow process user.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, which may violate GDPR (data protection), HIPAA (health information security), or other compliance requirements. Organizations using vulnerable versions may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Langflow to version 1.10.3 or later. Disable LANGFLOW_AUTO_LOGIN by setting it to false in the configuration. Restrict access to MCP server settings and API endpoints to authenticated admin users only.

Hi! I’m here to help you understand CVE-2026-105697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70