CVE-2026-105697: Langflow MCP Server RCE Vulnerability

CVE-2026-105697 Overview

Langflow is an open-source tool for building and deploying AI-powered agents and workflows. CVE-2026-105697 is a command injection vulnerability [CWE-78] in the Model Context Protocol (MCP) stdio transport. Before version 1.10.3, Langflow executed arbitrary commands supplied through MCP server configurations by wrapping them in bash -c "exec {command} ..." with no allowlist. Any user able to reach the MCP server settings or build a flow using the MCP Tools component could register a malicious server command. The command runs on the Langflow host as the Langflow process user as soon as Langflow attempts to connect.

Critical Impact
With the default LANGFLOW_AUTO_LOGIN=true, unauthenticated attackers can obtain a token via GET /api/v1/auto_login and achieve remote code execution on exposed Langflow instances.

Affected Products

Langflow versions prior to 1.10.3
langflow-base versions prior to 0.10.3
lfx versions prior to 1.10.3

Discovery Timeline

2026-10-05 - CVE-2026-105697 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105697

Vulnerability Analysis

The vulnerability resides in the MCP stdio transport implementation inside src/lfx/src/lfx/base/mcp/util.py. When Langflow connects to a configured MCP server, it takes the user-supplied command string and executes it through a shell wrapper (bash -c on Linux/macOS, cmd /c on Windows). No validation or allowlisting is applied to the command, so arbitrary operating system commands execute under the Langflow process user.

Execution is triggered simply by Langflow attempting to connect to the server. Listing servers, loading tools, or running a flow all invoke the connection path. The command fires even when the UI subsequently reports that the stdio server failed to start, so attackers get code execution regardless of whether the fake MCP server returns a valid protocol handshake.

Root Cause

The root cause is the absence of input validation on MCP server command configuration combined with shell-based process execution. Shell wrapping also opens the door to additional vectors including shell metacharacter injection, Internal Field Separator (IFS) manipulation, and BASH_ENV/BASH_FUNC_* startup injection.

Attack Vector

An attacker reaches the MCP server configuration via POST/PATCH /api/v2/mcp/servers/{server_name} or through the "Settings → MCP Servers → Add MCP Server" UI. On instances running the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login returns a valid token without credentials, enabling fully unauthenticated exploitation. With AUTO_LOGIN disabled, any authenticated non-admin user can still exploit the flaw.

python

         self._component_cache = component_cache
 
     async def _connect_to_server(self, command_str: str, env: dict[str, str] | None = None) -> list[StructuredTool]:
-        """Connect to MCP server using stdio transport (SDK style)."""
+        """Connect to MCP server using stdio transport (SDK style).
+
+        .. todo:: Remove the ``bash -c`` / ``cmd /c`` shell wrapper and pass
+           command + args directly to ``StdioServerParameters`` (i.e.
+           ``shell=False`` semantics).  This would eliminate an entire class of
+           injection vectors (shell metacharacters, IFS manipulation,
+           BASH_ENV/BASH_FUNC_* startup injection) and allow removing several
+           entries from ``DANGEROUS_ENV_VARS`` in ``schemas.py``.
+        """
         from mcp import StdioServerParameters
 
         command = shlex.split(command_str)

Source: GitHub Commit efbc4a16e

Detection Methods for CVE-2026-105697

Indicators of Compromise

Unexpected child processes of the Langflow process user, particularly bash -c or cmd /c invocations spawning network tools, shells, or file modification utilities.
HTTP requests to /api/v2/mcp/servers/{server_name} containing suspicious command strings such as curl, wget, nc, rm, or base64-encoded payloads.
Access to /api/v1/auto_login from untrusted source IP addresses on externally reachable Langflow instances.
Outbound connections from the Langflow host to unknown destinations immediately after MCP server configuration changes.

Detection Strategies

Monitor process-tree telemetry for the Langflow service account spawning shells or interpreters that are not part of normal application behavior.
Alert on write and PATCH requests to the MCP servers API endpoints and review the submitted command payloads.
Correlate Langflow API access logs with new outbound network sessions from the host within a short time window.

Monitoring Recommendations

Enable verbose audit logging for the Langflow API, including the request body for MCP configuration endpoints.
Baseline the expected child processes of Langflow and alert on deviations such as reverse shells or crypto miners.
Track configuration drift on LANGFLOW_AUTO_LOGIN and other authentication-related environment variables.

How to Mitigate CVE-2026-105697

Immediate Actions Required

Upgrade to Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3 without delay.
Set LANGFLOW_AUTO_LOGIN=false on any instance that is not a local development environment.
Place Langflow behind an authenticated reverse proxy or VPN and remove direct internet exposure.
Audit MCP server configurations for commands that do not match known-good binaries and remove any suspicious entries.

Patch Information

The fix is delivered in GitHub Release v1.10.3. Patch commits eba285edf1 and efbc4a16e introduce validate_mcp_stdio_config and an allowlist-based command policy to block arbitrary OS commands. Additional context is available in GitHub Pull Request #12290, GitHub Pull Request #14036, and the GitHub Security Advisory GHSA-w794-rj3p-xv45.

Workarounds

Disable AUTO_LOGIN and require strong authentication for all users accessing Langflow.
Restrict access to the MCP server configuration endpoints at the network or proxy layer until the patch is applied.
Run the Langflow process as a low-privilege user inside a container with a read-only filesystem and no outbound network egress to limit blast radius.
Remove the MCP Tools component from flows that do not require it.

bash

# Disable AUTO_LOGIN and enforce authentication
export LANGFLOW_AUTO_LOGIN=false
export LANGFLOW_SUPERUSER=admin
export LANGFLOW_SUPERUSER_PASSWORD='<strong-password>'

# Upgrade to patched release
pip install --upgrade 'langflow>=1.10.3' 'langflow-base>=0.10.3' 'lfx>=1.10.3'