- Description
- Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTO_LOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.
- Source
- security-advisories@github.com
- NVD status
- Undergoing Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 9.9
- Impact score
- 6
- Exploitability score
- 3.1
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- security-advisories@github.com
- CWE-78
- Hype score
- Not currently trending
#ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2024-25600 (CVSS: 10) CVE-2026-103849 (CVSS: 10) Adobe CVE-2026-61732 (CVSS: 10) BitterSecurity CVE-2025-49113 (CVSS: 9.9) roundcube CVE-2026-105697, CVE-2026-107824, CVE-2026-104120 (CVSS: 8.7) langflow-ai ..🧵👇
@exploitgrid
20 Oct 2026
95 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
加个MCP服务器，等于拿下主机。 Langflow＜1.10.3：MCP stdio的command无白名单，bash -c直接执行；默认AUTO_LOGIN还可免登。CVE-2026-105697，CVSS9.9——你的可视化编排，网络口还敞着吗？ https://t.co/o64cooXx5z
@dzqyzy
18 Oct 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Langflow's stdio MCP setup ran whatever command a user typed, via bash -c, right on the host. Two CVEs, both CVSS 9.9 (CVE-2026-105740 and CVE-2026-105697). With default auto-login on, an exposed instance didn't even need an account. Fixed in 1.10.3. https://t.co/mNbh6lMlrn
@VibeIncidents
15 Oct 2026
5 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
csirt_it: ‼️ #PoC #Langflow: disponibili Proof of Concept per le CVE-2026-105741, CVE-2026-105740, CVE-2026-105699 e CVE-2026-105697 Rischio: 🔴 Tra le tipologie: 🔸 Remote Code Execution 🔸 Security Feature Bypass 🔗 https://t.co/Z9Szmiem1Y ⚠️ Impor… https:
@Vulcanux_
6 Oct 2026
28 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
‼️ #PoC #Langflow: disponibili Proof of Concept per le CVE-2026-105741, CVE-2026-105740, CVE-2026-105699 e CVE-2026-105697 Rischio: 🔴 Tra le tipologie: 🔸 Remote Code Execution 🔸 Security Feature Bypass 🔗 https://t.co/9wVGLszwaL ⚠️ Importante mantenere aggi
@csirt_it
6 Oct 2026
315 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes