Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)
Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed.
What it is
GitHub advisory GHSA-w794-rj3p-xv45 (CVE-2026-105697): before 1.10.3 “the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist”, wrapped in bash -c.
The command runs as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow), even if the UI then says the server failed to start.
With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so an exposed default install is reachable without an account. With auto-login off, any authenticated non-admin user can do it.
CVE-2026-105740 (GHSA-7w94-79vh-5mr2) is the earlier report of the same flaw via “Add MCP Server”, fixed in 1.9.0. It also allowed injecting environment variables such as LD_PRELOAD. 1.9.0 only blocked the settings API; configs embedded in flows or passed as tweaks still ran until 1.10.3.
How to check
- Affected: langflow 1.1.2 up to (not including) 1.10.3, langflow-base 0.1.2 up to 0.10.3, and lfx below 1.10.3.
- Check whether LANGFLOW_AUTO_LOGIN is still on and whether your instance is reachable from the internet.
How to fix
- Upgrade to Langflow 1.10.3 or later (langflow-base 0.10.3, lfx 1.10.3). It enforces a command allowlist at the API, at flow execution and before the process starts, and no longer uses a shell.
- Turn off LANGFLOW_AUTO_LOGIN on anything other than a local dev machine.
- Review existing MCP server configs and flows for commands you didn’t add.
pip show langflow | grep Version
pip install -U "langflow>=1.10.3"