CVE-2026-105697: Langflow Ran Any OS Command Placed in an MCP stdio Server Config (CVSS 9.9); the 1.9.0 Fix Was Incomplete Until 1.10.3
CVE-2026-105697 is a critical-severity remote code execution issue (CVSS 9.9) in langflow, a MCP server. Affected: >=1.1.2 <1.10.3. Fixed in 1.10.3.
Is langflow running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-105697- Aliases
- GHSA-w794-rj3p-xv45
- Severity
- critical
- CVSS score
- 9.9
- Attack type
- Remote code execution, Command injection
- Component
- langflow · MCP server
- Package
langflow- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-105697?
Langflow published GHSA-w794-rj3p-xv45 on 28 September 2026, and NVD published CVE-2026-105697 on 5 October with a CVSS 3.1 score of 9.9. Before 1.10.3, the MCP stdio transport launched whatever command and args a user put in an MCP server configuration, with no allowlist, wrapped in `bash -c "exec {command} ..."`. Any user who could reach Settings > MCP Servers, the POST/PATCH /api/v2/mcp/servers/{server_name} API, or the MCP Tools component in a flow could run a command as the Langflow process user, and it runs as soon as Langflow tries to connect, even when the UI reports that the server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login issues a token without credentials, so an exposed default instance needs no account; with auto-login off, any authenticated non-admin user can exploit it. An earlier advisory (GHSA-7w94-79vh-5mr2, CVE-2026-105740, 10 September) was fixed in 1.9.0 by an allowlist at the REST model only, so 1.9.0 to 1.10.2 remain exploitable through MCP configs embedded in flows or passed as tweaks; 1.10.3 enforces the policy at execution and removes the shell. The advisory is in the GitHub Advisory Database and OSV, and the reporter says they found several internet-facing vulnerable servers.
Affected versions
| Affected | Fixed in |
|---|---|
>=1.1.2 <1.10.3 | 1.10.3 |
Am I affected by CVE-2026-105697?
You are affected if you run langflow >=1.1.2 <1.10.3. Versions 1.10.3 and later include the fix.
How do I fix CVE-2026-105697?
Upgrade langflow and lfx to 1.10.3 or later and langflow-base to 0.10.3 or later; do not treat 1.9.x as safe. Set LANGFLOW_AUTO_LOGIN=false on any instance reachable from a network and remove direct internet exposure. On multi-tenant deployments set LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES, LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true, and on 1.11.1+ restrict custom code (LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true), which also limits MCP stdio servers to superusers. Review existing MCP server configs and flows for unexpected stdio commands, and treat any exposed vulnerable host as possibly compromised.
How do I find every machine running langflow?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run langflow and which version, then enforce a policy on it.