plaincve:~$

// threat brief

CVE-2026-105697

Langflow MCP stdio command injection: whatever command the server config names, the host runs

CVSS
9.9 CRITICAL
CISA KEV
Not listed
Weakness
CWE-78
Topics
AI security

PlainCVE Team · Published 2026-10-13 · AI-assisted · Press brief ↓

AI review 2026-10-13 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Langflow before 1.10.3 runs any command in MCP stdio configs, letting users, or anyone reaching an exposed default auto-login instance, run code on the host.

Who is affectedDeployments running langflow 1.1.2 up to (not including) 1.10.3, langflow-base 0.1.2 up to 0.10.3, or lfx before 1.10.3. Versions 1.9.0 to 1.10.2 are only partly fixed and remain affected.
What happensAn attacker can run arbitrary commands on the Langflow host as the user the Langflow process runs as (remote code execution).
What to do nowUpgrade to Langflow 1.10.3 or later (langflow-base 0.10.3, lfx 1.10.3). If you can't upgrade yet, set LANGFLOW_AUTO_LOGIN=false, keep Langflow off untrusted networks, and give accounts only to trusted users. PlainCVE's advice, because an IBM bulletin lists Langflow OSS 1.0.0–1.10.3 as still affected by other MCP-related flaws, is to go straight to 1.11.0 or later (the official fix for this flaw remains 1.10.3).
Affected versionslangflow >= 1.1.2, < 1.10.3; langflow-base >= 0.1.2, < 0.10.3; lfx < 1.10.3 (1.9.0–1.10.2 are only partly fixed and still affected)
Fixed versionslangflow 1.10.3 or later (including 1.11.0+), langflow-base 0.10.3, lfx 1.10.3
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Timeline
  • First public 2026-03-23

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your package versions

    You are affected if langflow is below 1.10.3, langflow-base below 0.10.3, or lfx below 1.10.3. Note that 1.9.0–1.10.2 are only partly fixed and still need upgrading. Run the read-only command below in the Python environment Langflow actually uses (for example, activate its virtual environment first; for Docker deployments, run it inside the Langflow container). The command hides error messages, so no output only means these packages are not installed in that environment; it does not mean you are safe, and you may simply be in the wrong environment (PlainCVE's note).

    Read-only check
    pip show langflow langflow-base lfx 2>/dev/null | grep -iE '^(name|version)'
  2. 02Check whether auto-login is still on

    LANGFLOW_AUTO_LOGIN defaults to true; if Langflow is also reachable from outside, the flaw can be used without an account. The vendor documents this setting as development-only. Check the configuration Langflow is actually started with: its .env file, Docker (the docker compose file or environment variables passed to docker run), or the systemd service settings, and confirm LANGFLOW_AUTO_LOGIN is explicitly set to false. If the setting is not there, the default true is in effect (PlainCVE's note).

    Step 1
  3. 03Watch for unexpected child processes from Langflow

    This is TheHackerWire's suggestion; the vendor gives no detection guidance. Remember the command runs as soon as Langflow tries to connect, even if the UI reports a failed start.

    Step 3Step 4
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to Langflow 1.10.3 or later (changes your environment)

    The vendor says the issue is fully fixed only in 1.10.3 (and 1.11.0+): the allowlist is enforced where the command runs, and bash -c is gone. The command below changes your environment (it upgrades installed packages); run it in the Python environment Langflow actually uses (for example its virtual environment).

    Changes your environment
    pip install -U "langflow>=1.10.3"
    Step 2Step 3
  2. 02PlainCVE's advice: go straight to 1.11.0 or later

    An IBM security bulletin (https://www.ibm.com/support/pages/security-bulletin-langflow-affected-security-vulnerabilities-model-context-protocol-features) lists Langflow OSS 1.0.0–1.10.3 as affected by other MCP-related flaws and recommends upgrading to 1.11.0 or newer. PlainCVE therefore suggests going straight to 1.11.0 or later. This is PlainCVE's advice; the official fix for this flaw remains 1.10.3.

    Step 2Step 3
  3. 03Can't upgrade yet: turn off auto-login and stay off untrusted networks

    The vendor advises setting LANGFLOW_AUTO_LOGIN=false and not exposing Langflow directly to untrusted networks.

    Step 1
  4. 04Give accounts only to trusted users

    Vendor advice. On unpatched versions, any logged-in non-admin user can exploit this flaw.

    Step 1Step 2
RESPONDRespondIf you find signs of compromise
  1. 01Treat the host as possibly compromised

    PlainCVE's suggestion (our sources show no vendor incident-response guidance): if you find suspicious child processes, assume the attacker had everything the Langflow process user can reach, and investigate and clean up on that basis.

    Step 4
  2. 02Review MCP server configs and flows

    PlainCVE's suggestion: review MCP server settings and MCP Tools components embedded in flows for commands you don't recognise. Users of 1.9.0–1.10.2 should pay special attention to flow-embedded configs, since those skip the API check.

    Step 2
HARDENHardenPrevent the next one
  1. 01Mind the remaining npx / uvx risk

    The vendor notes that even on 1.10.3+, the allowlist still lets npx and uvx run any package by default; multi-tenant deployments should apply the extra hardening settings the vendor recommends.

    Step 2Step 3
  2. 02Don't put Langflow directly on the internet

    The reporter found several internet-facing Langflow servers that were vulnerable.

    Step 1
Full remediation steps and notes
  1. Upgrade all three packages (changes your environment). In the Python environment Langflow actually uses, run pip install -U "langflow>=1.10.3"; if you use langflow-base or lfx directly, move them to 0.10.3 and 1.10.3 or later. If you’re on 1.9.0–1.10.2, you still need to upgrade: that range is only half fixed.
  2. After upgrading. The vendor notes the allowlist still lets npx and uvx run any package by default; shared (multi-tenant) deployments should apply the extra hardening settings the vendor recommends.
  3. Auto-login. The vendor documents AUTO_LOGIN as development-only. PlainCVE suggests setting it to false in production whether or not you’ve upgraded.
  4. PlainCVE’s advice: go straight to 1.11.0 or later. An IBM security bulletin lists Langflow OSS 1.0.0–1.10.3 as still affected by other MCP-related flaws and recommends upgrading to 1.11.0 or newer, so PlainCVE suggests going straight to 1.11.0 or later. The official fix for this flaw remains 1.10.3.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

Langflow MCP stdio command injection: whatever command the server config names, the host runs: 1. Reaches Langflow and gets a user session → 2. Adds an MCP stdio server config that names an arbitrary command → 3. When Langflow tries to connect, it launches the command via bash -c → 4. The command runs on the host as the Langflow process userCVE-2026-105697 · Langflow MCP stdio command injection: whatever command the serverconfig names, the host runsAttackerYour systemReaches Langflow and gets a user session — The attacker must be able to reach Langflow over the network. With the default LANGFLOW_AUTO_LOGIN=true, an auto-login endpoint hands out a token (a login credential) without a password, so no account is needed; with auto-login off, any logged-in non-admin user can exploit it. 1Reaches Langflowand gets a usersessionAdds an MCP stdio server config that names an arbitrary command — This can go through the MCP server settings, an MCP Tools component inside a flow, or a tweak (a run-time parameter override). In 1.9.0–1.10.2 only the REST API checks it, so configs embedded in flows or passed as tweaks skip the check. 2Adds an MCP stdioserver config thatnames an arbitrarycommandWhen Langflow tries to connect, it launches the command via bash -c — The command runs as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow), even if the UI says the server failed to start. Older versions had no allowlist and wrapped it in a shell. 3When Langflowtries to connect,it launches thecommand via bash -cThe command runs on the host as the Langflow process user — The result is remote code execution with the privileges of the user the Langflow process runs as, not necessarily root. 4The command runson the host as theLangflow processuserAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-105697-langflow-mcp-stdio-command-injection · CC BY 4.0
Langflow MCP stdio command injection: whatever command the server config names, the host runs: 1. Reaches Langflow and gets a user session → 2. Adds an MCP stdio server config that names an arbitrary command → 3. When Langflow tries to connect, it launches the command via bash -c → 4. The command runs on the host as the Langflow process userCVE-2026-105697 · Langflow MCP stdiocommand injection: whatever command theserver config names, the host runsReaches Langflow and gets a user session — The attacker must be able to reach Langflow over the network. With the default LANGFLOW_AUTO_LOGIN=true, an auto-login endpoint hands out a token (a login credential) without a password, so no account is needed; with auto-login off, any logged-in non-admin user can exploit it. 1AttackerReaches Langflow and gets auser sessionAdds an MCP stdio server config that names an arbitrary command — This can go through the MCP server settings, an MCP Tools component inside a flow, or a tweak (a run-time parameter override). In 1.9.0–1.10.2 only the REST API checks it, so configs embedded in flows or passed as tweaks skip the check. 2AttackerAdds an MCP stdio server configthat names an arbitrary commandWhen Langflow tries to connect, it launches the command via bash -c — The command runs as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow), even if the UI says the server failed to start. Older versions had no allowlist and wrapped it in a shell. 3Your systemWhen Langflow tries to connect,it launches the command viabash -cThe command runs on the host as the Langflow process user — The result is remote code execution with the privileges of the user the Langflow process runs as, not necessarily root. 4Your systemThe command runs on the host asthe Langflow process userAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-105697-langflow-mcp-stdio-command-injection
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    Reaches Langflow and gets a user session

    The attacker must be able to reach Langflow over the network. With the default LANGFLOW_AUTO_LOGIN=true, an auto-login endpoint hands out a token (a login credential) without a password, so no account is needed; with auto-login off, any logged-in non-admin user can exploit it.

    Defense: Set LANGFLOW_AUTO_LOGIN=false, keep Langflow off untrusted networks, and give accounts only to trusted users.

  2. Attacker

    Adds an MCP stdio server config that names an arbitrary command

    This can go through the MCP server settings, an MCP Tools component inside a flow, or a tweak (a run-time parameter override). In 1.9.0–1.10.2 only the REST API checks it, so configs embedded in flows or passed as tweaks skip the check.

    Defense: Upgrade to 1.10.3+, where the command allowlist is enforced at the point the command is actually run, covering flows and tweaks.

  3. Your system

    When Langflow tries to connect, it launches the command via bash -c

    The command runs as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow), even if the UI says the server failed to start. Older versions had no allowlist and wrapped it in a shell.

    Defense: 1.10.3 removes the bash -c wrapper, starts the process directly, and checks again right before launch.

  4. Your system

    The command runs on the host as the Langflow process user

    The result is remote code execution with the privileges of the user the Langflow process runs as, not necessarily root.

    Defense: TheHackerWire suggests watching for unexpected child processes started by the Langflow user.

Who is affected

Package (PyPI)Affected versionsFixed version
langflow>= 1.1.2, < 1.10.31.10.3 (and 1.11.0+)
langflow-base>= 0.1.2, < 0.10.30.10.3
lfx< 1.10.31.10.3
SituationAffected?
1.1.2–1.8.xAffected, with no command checks at all
1.9.0–1.10.2Still affected: the API rejects disallowed commands, but configs embedded in flows or passed as tweaks skip that check
1.10.3 or laterFully fixed, per the vendor
Default LANGFLOW_AUTO_LOGIN=true and reachable from outsideThe vendor advisory GHSA-w794-rj3p-xv45 (the page contains exploit code, so we don’t link it) says it can be exploited without an account
Auto-login turned offAny logged-in non-admin user can still exploit it

The attacker must be able to reach Langflow over the network and either open the MCP server settings or build a flow with the MCP Tools component.

How it works

Langflow can connect to MCP servers (MCP is a protocol that lets AI call external tools). One connection type is stdio: Langflow starts a program on its own host and talks to it through standard input and output. Which program to start, and with which arguments, is filled in by the user in the configuration.

The problem is that before 1.10.3 Langflow took those fields at face value: there was no allowlist, and the command was wrapped in bash -c and handed to a shell. So “configuring an MCP server” really meant “running any command on the host.” The command runs as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow), even if the UI says the server failed to start. This is CWE-78 (OS command injection).

The flaw goes back to the MCP Stdio component added in PR #5148 (around 1.1.2–1.4.x). The vendor fixed it in two steps:

  • 1.9.0 (PR #12290): added a command allowlist plus argument and environment-variable checks to the REST API’s config model. But the place that actually runs the command had no check and still used bash -c.
  • 1.10.3 (PR #14036, commit eba285e): applied the same policy where the command is actually run, covering configs embedded in flows and tweaks, and removed bash -c, so the process now starts directly without a shell.

The flawed approach (conceptual illustration, not the original source code):

Show code example(python)
# The user's command is handed to a shell unchanged
run(["bash", "-c", f"exec {config.command} {' '.join(config.args)}"])

The fixed approach:

Show code example(python)
# Check the allowlist right before launching, and don't use a shell
validate_against_allowlist(config.command, config.args, config.env)
spawn_directly(config.command, config.args)

Timeline

DateEvent
2026-01-11OX Security says it reported the issue to Langflow (per OX Security’s own account in its blog post “Mother of all AI supply chains”; that post contains an attack demonstration, so we don’t link it)
2026-03-18OX Security says Langflow acknowledged it inside the GHSA report
2026-03-23First-step fix PR #12290 opened in the public repo (later shipped in 1.9.0); it describes this MCP stdio command injection and cites GHSA-w794-rj3p-xv45, so under our rules this is the first disclosure
2026-07-13Complete fix PR #14036 opened
23 July1.10.3 released (GitHub shows no year; 2026 is PlainCVE’s inference)
2026-09-28Maintainers publish the vendor advisory GHSA-w794-rj3p-xv45 (per the publication date shown on that advisory page; the page contains exploit code, so we don’t link it. The CVE record’s source.advisory field gives this ID)
2026-10-05CVE record published
2026-10-06CISA SSVC assessment: exploitation none, automatable no, technical impact total
2026-10-07Not in CISA KEV; NVD status “Undergoing Analysis”

Further reading

  • Scoring: the CNA (GitHub) gives CVSS 3.1 9.9, and the vendor advisory GHSA-w794-rj3p-xv45 (the page contains exploit code, so we don’t link it) rates it critical. As of 2026-10-07 NVD is still analysing it, and we found no NVD score.
  • Is login needed? The vendor’s own sources differ: PR #12290 says “unauthenticated attackers” could exploit it, with no conditions; the advisory GHSA-w794-rj3p-xv45 (the page contains exploit code, so we don’t link it) says no account is needed only when the default AUTO_LOGIN is on, and the CVSS vector lists low privileges (PR:L).
  • Exploitation: no source confirms exploitation in the wild or as a zero-day. The reporter found several vulnerable internet-facing servers, but that is not evidence they were attacked.
  • Public PoC: the vendor advisory itself includes a proof of concept for 1.5.0–1.8.x (the page contains exploit code, so we don’t link it or reproduce it); TheHackerWire said that, at the time of writing, no standalone exploit had been published in open research repositories.
  • Related flaws: an IBM security bulletin covers other Langflow MCP CVEs (such as CVE-2026-17623) but does not mention this one; it lists Langflow OSS 1.0.0–1.10.3 as affected by those flaws and recommends upgrading to 1.11.0 or later. PlainCVE could not establish whether they overlap with this CVE; based on that bulletin, PlainCVE suggests going straight to 1.11.0 or later (see “How to fix”).
  • For detection, the vendor gives no guidance; TheHackerWire suggests watching for unexpected child processes started by the Langflow user.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-13 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2026-105697 record (CVE Services API) · CVE Program, 2026-10-05 · accessed 2026-10-07
  2. CVE / NVD / OSVNVD API - CVE-2026-105697 · NIST · accessed 2026-10-07
  3. Patch / releasefix(security): harden MCP stdio configuration (#14036) — commit eba285e · Langflow (GitHub) · accessed 2026-10-07
  4. Patch / releaseLangflow v1.10.3 release · Langflow (GitHub) · accessed 2026-10-07
  5. Patch / releasePR #12290 — MCP command allowlist and validation (REST model) · Langflow (GitHub), 2026-03-23 · accessed 2026-10-07
    First public disclosure of this flaw
  6. Patch / releasePR #14036 — harden MCP stdio configuration · Langflow (GitHub), 2026-07-13 · accessed 2026-10-07
  7. NewsCVE-2026-105697: Langflow OS command injection enables unauthenticated remote code execution · TheHackerWire · accessed 2026-10-07
  8. AdvisorySecurity Bulletin: Langflow affected by security vulnerabilities in Model Context Protocol features · IBM · accessed 2026-10-07

Press brief

In one sentence

Langflow is an open-source tool for building and deploying AI agents and workflows. Versions before 1.10.3 run any command a user writes into an MCP server configuration, letting an attacker execute code on the server; if the instance is reachable from untrusted networks and still uses the default auto-login setting, no account is needed. The CNA scored it CVSS 9.9 (Critical), and the vendor fully fixed it in 1.10.3. As of October 7, 2026, it is not on the US CISA Known Exploited Vulnerabilities list.

Key facts

Severity
CVSS 3.1 9.9 (CNA score; NVD still analysing) cveawg.mitre.org
Fully fixed version
Langflow 1.10.3 (langflow-base 0.10.3, lfx 1.10.3) cveawg.mitre.org
First disclosed (project's public PR #12290)
2026-03-23 github.com
CVE published
2026-10-05 cveawg.mitre.org
Vendor advisory
GHSA-w794-rj3p-xv45 cveawg.mitre.org

Confirmed

  • Langflow before 1.10.3 runs any command in an MCP stdio server config with no allowlist, leading to remote code execution.
  • The vendor says 1.10.3 (and 1.11.0+) is fully fixed; 1.9.0–1.10.2 are only partly fixed.
  • Not in CISA KEV as of 2026-10-07; CISA's SSVC assessment rates exploitation as "none".

Unconfirmed / disputed

  • Whether login is needed: the vendor's PR #12290 says unauthenticated attackers could exploit it; the vendor advisory GHSA-w794-rj3p-xv45 (the page contains exploit code, so we don't link it) says that is only true under the default AUTO_LOGIN, and CVSS lists low privileges.
  • No source confirms exploitation in the wild, or exploitation before a patch existed (zero-day).
  • Public PoC: the vendor advisory itself includes a proof of concept for 1.5.0–1.8.x (the page contains exploit code, so we don't link it), while TheHackerWire said that, at the time of writing, no standalone exploit had been published in open research repositories; the two differ.
  • The 1.10.3 release year: GitHub shows only "23 Jul"; 2026 is PlainCVE's inference.

Quotable line

Letting a user "configure a tool" here was really letting them type commands on your server.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Langflow MCP stdio command injection: whatever command the server config names, the host runs". PlainCVE. https://plaincve.date/en/vulns/cve-2026-105697-langflow-mcp-stdio-command-injection (accessed YYYY-MM-DD)
BibTeX
@misc{cve2026105697langflowmcpstdiocommandinjection2026,
  title  = {Langflow MCP stdio command injection: whatever command the server config names, the host runs},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-105697-langflow-mcp-stdio-command-injection},
  note   = {Updated 2026-10-13}
}