Is CVE-2026-105697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105697 being exploited in the wild.

How severe is CVE-2026-105697?

Critical severity, with a CVSS score of 9.9, published 5 October 2026.

Which products and versions are affected?

Langflow before 1.10.3; Langflow-Base before 0.10.3; Langflow Lfx before 1.10.3; langflow (PyPI) >= 1.1.2, < 1.10.3, ECOSYSTEM:introduced=1.1.2,fixed=1.10.3; and 2 more.

How is CVE-2026-105697 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105697?

Check whether you run Langflow, Langflow-Base, Langflow Lfx or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105697: Langflow MCP stdio command injection

Q: Is there a fix for CVE-2026-105697?

Yes. langflow (PyPI): upgrade to 1.10.3 or later; langflow-base (PyPI): upgrade to 0.10.3 or later; lfx (PyPI): upgrade to 1.10.3 or later. Until then: Disable the LANGFLOW_AUTO_LOGIN setting to require authentication, and restrict access to the /api/v2/mcp/servers API endpoints and MCP configuration UI to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-105697 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-105697?

Check whether you run Langflow, Langflow-Base, Langflow Lfx or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105697 · Severity: critical · CVSS 9.9 · Published 2026-10-05

Langflow is a platform for building AI-powered workflows and agents. Before version 1.10.3, an attacker could inject arbitrary operating system commands through the MCP server configuration interface, allowing remote code execution on the Langflow host. On instances with default settings, this could be exploited without authentication; on secured instances, any non-admin user could trigger it.

Technologies: Langflow, Langflow-Base, Langflow Lfx, langflow (PyPI), langflow-base (PyPI). Vendors: Langflow, PyPI.

Quick answers

Is CVE-2026-105697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105697 being exploited in the wild.
How severe is CVE-2026-105697?: Critical severity, with a CVSS score of 9.9, published 5 October 2026.
Which products and versions are affected?: Langflow before 1.10.3; Langflow-Base before 0.10.3; Langflow Lfx before 1.10.3; langflow (PyPI) >= 1.1.2, < 1.10.3, ECOSYSTEM:introduced=1.1.2,fixed=1.10.3; and 2 more.
Is there a fix for CVE-2026-105697?: Yes. langflow (PyPI): upgrade to 1.10.3 or later; langflow-base (PyPI): upgrade to 0.10.3 or later; lfx (PyPI): upgrade to 1.10.3 or later. Until then: Disable the LANGFLOW_AUTO_LOGIN setting to require authentication, and restrict access to the /api/v2/mcp/servers API endpoints and MCP configuration UI to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105697 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105697?: Check whether you run Langflow, Langflow-Base, Langflow Lfx or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

langflow (PyPI): upgrade to 1.10.3 or later
```
pip install "langflow>=1.10.3"
```
langflow-base (PyPI): upgrade to 0.10.3 or later
```
pip install "langflow-base>=0.10.3"
```
lfx (PyPI): upgrade to 1.10.3 or later
```
pip install "lfx>=1.10.3"
```

Disable the LANGFLOW_AUTO_LOGIN setting to require authentication, and restrict access to the /api/v2/mcp/servers API endpoints and MCP configuration UI to trusted users only.

Technical details

The vulnerability exists in the MCP stdio transport handler, which executed user-supplied commands without an allowlist or validation. Commands were wrapped in bash -c, enabling shell metacharacter injection. The attack requires reaching the MCP server settings API endpoint (POST/PATCH /api/v2/mcp/servers/{server_name}) or using the MCP Tools component to build a flow. With LANGFLOW_AUTO_LOGIN=true (the default), unauthenticated access is possible via GET /api/v1/auto_login.

Affected products

Langflow Langflow before 1.10.3
Langflow langflow-base before 0.10.3
Langflow lfx before 1.10.3

Identifiers

CVE-2026-105697
GHSA-w794-rj3p-xv45
PYSEC-2026-4237
PYSEC-2026-4239
PYSEC-2026-4241

Timeline

2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.