Kalyxo
Langflow MCP stdio flaws required two fixes
Published
CVE-2026-105740 covers the server-settings path patched in Langflow 1.9.0. A separate advisory tracks command execution through MCP Tools flows and tweaks until the 1.10.3 fix.
Two Langflow advisories describe command injection through the MCP stdio transport. They cover related code paths, with different affected ranges and fixes.
The first report, CVE-2026-105740, concerns adding a Stdio MCP server through Langflow's server settings. The advisory says a regular authenticated user could supply a command and environment values; Langflow passed the command to bash -c when it fetched the server list. GitHub lists Langflow 1.8.3 as affected and 1.9.0 as patched. The CVE record describes the affected range as versions before 1.9.0. This path did not require an administrator account. (Langflow advisory GHSA-7w94-79vh-5mr2; NVD record for CVE-2026-105740)
A second, separately tracked advisory maps to CVE-2026-105697. It covers command execution through MCP Tools values embedded in flows or supplied as tweaks. Its package ranges are langflow 1.1.2 through 1.10.2, langflow-base 0.1.2 through 0.10.2, and lfx before 1.10.3. The corresponding fixes are langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3. The advisory says an exposed instance with the development-only LANGFLOW_AUTO_LOGIN=true can provide access without credentials; with auto-login disabled, an authenticated non-admin user who can reach MCP settings or build an MCP Tools flow can still reach the vulnerable path. (Langflow advisory GHSA-w794-rj3p-xv45; NVD record for CVE-2026-105697)
The 1.9.0 change did not cover every route
Langflow's 1.9.0 release added validation at the MCP server settings API. The later advisory says that validation did not run at the command-execution sink for configurations embedded in a flow or passed as a tweak. Those routes remained vulnerable through 1.10.2. Version 1.10.3 applies validation at the API, flow execution, and immediately before process creation, and removes the shell wrapper.
Administrators should identify all three Python packages in use and upgrade to the fixed versions for each. In particular, 1.9.0 closes the original server-settings path but does not close the separately described flow and tweak paths. This is a Langflow implementation flaw, not a vulnerability in the MCP protocol itself.