# CVE-2026-105697: Langflow MCP stdio command injection

Source: https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105697 · Severity: critical · CVSS 9.9 · Published 2026-10-05

Langflow is a platform for building AI-powered workflows and agents. Before version 1.10.3, an attacker could inject arbitrary operating system commands through the MCP server configuration interface, allowing remote code execution on the Langflow host. On instances with default settings, this could be exploited without authentication; on secured instances, any non-admin user could trigger it.

Technologies: [Langflow](https://junglewise.ai/threats/technologies/langflow), [Langflow-Base](https://junglewise.ai/threats/technologies/langflow-langflow-base), [Langflow Lfx](https://junglewise.ai/threats/technologies/lfx), [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow), [langflow-base (PyPI)](https://junglewise.ai/threats/technologies/langflow-base). Vendors: [Langflow](https://junglewise.ai/threats/vendors/langflow), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-105697 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105697 being exploited in the wild.

**How severe is CVE-2026-105697?** Critical severity, with a CVSS score of 9.9, published 5 October 2026.

**Which products and versions are affected?** Langflow before 1.10.3; Langflow-Base before 0.10.3; Langflow Lfx before 1.10.3; langflow (PyPI) >= 1.1.2, < 1.10.3, ECOSYSTEM:introduced=1.1.2,fixed=1.10.3; and 2 more.

**Is there a fix for CVE-2026-105697?** Yes. langflow (PyPI): upgrade to 1.10.3 or later; langflow-base (PyPI): upgrade to 0.10.3 or later; lfx (PyPI): upgrade to 1.10.3 or later. Until then: Disable the LANGFLOW_AUTO_LOGIN setting to require authentication, and restrict access to the /api/v2/mcp/servers API endpoints and MCP configuration UI to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105697 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105697?** Check whether you run Langflow, Langflow-Base, Langflow Lfx or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.10.3 or later

  ```sh
  pip install "langflow>=1.10.3"
  ```

- langflow-base (PyPI): upgrade to 0.10.3 or later

  ```sh
  pip install "langflow-base>=0.10.3"
  ```

- lfx (PyPI): upgrade to 1.10.3 or later

  ```sh
  pip install "lfx>=1.10.3"
  ```


Disable the LANGFLOW_AUTO_LOGIN setting to require authentication, and restrict access to the /api/v2/mcp/servers API endpoints and MCP configuration UI to trusted users only.

## Technical details

The vulnerability exists in the MCP stdio transport handler, which executed user-supplied commands without an allowlist or validation. Commands were wrapped in bash -c, enabling shell metacharacter injection. The attack requires reaching the MCP server settings API endpoint (POST/PATCH /api/v2/mcp/servers/{server_name}) or using the MCP Tools component to build a flow. With LANGFLOW_AUTO_LOGIN=true (the default), unauthenticated access is possible via GET /api/v1/auto_login.

## Affected products

- Langflow Langflow before 1.10.3
- Langflow langflow-base before 0.10.3
- Langflow lfx before 1.10.3

## Identifiers

- CVE-2026-105697
- GHSA-w794-rj3p-xv45
- PYSEC-2026-4237
- PYSEC-2026-4239
- PYSEC-2026-4241

## Timeline

- 2026-10-05: disclosed

## References

- [https://github.com/langflow-ai/langflow/commit/eba285edf1dd4a33bf23a9cb8113c991fcdf3d1d](https://github.com/langflow-ai/langflow/commit/eba285edf1dd4a33bf23a9cb8113c991fcdf3d1d)
- [https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0](https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow code injection in validate_code endpoint](https://junglewise.ai/threats/duplicate-advisory-title-authenticated-remote-code-execution-in-65a053a9)