CVE-2026-105697 in Langflow
Summary
by MITRE • 10/06/2026
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTO_LOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
Langflow serves as a platform for constructing and deploying artificial intelligence agents and automated workflows, yet prior to version 1.10.3 it contained a critical remote code execution vulnerability within its Model Context Protocol implementation. The core technical flaw resides in the stdio transport mechanism used by MCP servers configured through the application interface. When an administrator or user with access to server settings adds a new MCP server, they can specify arbitrary command-line arguments for that server's executable. In versions prior to 1.10.3, these commands were not subject to any allowlist restrictions and were further wrapped in bash -c exec syntax before execution. This design choice effectively bypassed standard shell escaping protections, allowing an attacker to inject complex shell metacharacters such as semicolons or pipes to chain multiple commands together. Consequently, the system does merely launch a specific tool but instead executes fully arbitrary operating system commands on the host machine where Langflow is running.
The operational impact of this vulnerability is severe because it grants attackers full control over the underlying infrastructure associated with the Langflow instance. The malicious command execution occurs whenever the application attempts to interact with the configured server, such as when listing available servers, loading tools for a workflow, or attempting to run a flow that utilizes MCP Tools components. Notably, this code execution happens even if the user interface subsequently reports that the stdio server failed to start correctly, meaning the attack is successful regardless of whether the intended AI tool functions properly. The commands are executed with the privileges of the Langflow process user, which often possesses significant permissions depending on how the service was deployed. This allows for actions ranging from simple file manipulation like creating or deleting files using touch and rm -rf to more sophisticated attacks such as establishing reverse shells that provide persistent remote access to the compromised host.
Access vectors for this vulnerability vary based on the deployment configuration but remain broadly exploitable in default setups. By enabling LANGFLOW_AUTO_LOGIN=true, which is documented primarily as a development-only setting, the application issues authentication tokens without requiring valid credentials via the GET /api/v1/auto_login endpoint. On an exposed instance running with these defaults, any unauthenticated attacker can obtain the necessary token to access administrative endpoints like POST or PATCH requests to /api/v2/mcp/servers/{server_name}. Even when auto-login is disabled as recommended for production environments, authenticated non-administrative users retain the ability to exploit this flaw by adding malicious server configurations through the UI. This highlights a significant privilege escalation path where lower-privileged accounts can compromise the entire system integrity.
To mitigate this risk, organizations must immediately upgrade Langflow and its associated base packages to version 1.10.3 or later, which implements proper input validation and restricts command execution to safe parameters. For deployments that cannot be upgraded instantly, it is critical to ensure LANGFLOW_AUTO_LOGIN remains disabled in production environments to prevent unauthenticated access. Additionally, administrators should enforce strict network segmentation so that the Langflow management interface is not directly exposed to untrusted networks. Implementing a reverse proxy with Web Application Firewall rules can also help filter out malicious payloads attempting to inject shell metacharacters into configuration endpoints. From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is consistent with ATT&CK techniques involving command and script interpretation for initial access and persistence on compromised systems.