CVE-2026-105697: Langflow OS Command Injection Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-105697: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration. Affects langflow versions >= 1.1.2, < 1.10.3. Fixed in 1.10.3. How to fix ↓
Also tracked for
- langflow-base · PyPI
- lfx · PyPI
The same CVE-2026-105697 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source framework designed for building and managing workflows that integrate various components and tools. It allows users to configure and run multiple servers, including the MCP (Multi-Component Protocol) server, which facilitates communication between different components. However, prior to version 1.10.3, Langflow had a critical vulnerability that allowed arbitrary OS commands to be executed through improper handling of user inputs in the MCP server configuration.
Vulnerability Detail
The vulnerability arises from the MCP stdio transport's lack of input validation, allowing users to specify any command and its arguments in the server configuration. This command is executed on the Langflow host without any restrictions, leading to potential remote code execution (RCE). The vulnerability is exacerbated by the default setting of LANGFLOW_AUTO_LOGIN, which permits unauthenticated access to the MCP server settings. Attackers can exploit this vulnerability to execute arbitrary commands, such as creating or deleting files, or even launching reverse shells, thereby compromising the host system.
How To Fix
Latest published version: 1.14.0.dev2 as of 22 Oct 2026
pip install --upgrade "langflow==1.14.0.dev2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.3
This is the first release that contains the fix.
pip install --upgrade "langflow==1.10.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can mitigate the risk by setting LANGFLOW_AUTO_LOGIN=false to prevent unauthenticated access. It is also advisable to restrict access to Langflow to trusted users only and avoid exposing it to untrusted networks.
Conclusion
The vulnerability CVE-2026-105697 in Langflow poses a significant risk due to its potential for remote code execution. Users are strongly encouraged to upgrade to the patched versions to secure their installations. In the meantime, implementing workarounds can help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for langflow →
FAQ
CVE-2026-105697 is a critical vulnerability in Langflow that allows remote code execution through improper handling of user inputs in the MCP server configuration.
If you are using Langflow versions between 1.1.2 and 1.10.2, your installation is vulnerable. You can check your version using pip show langflow.
Exploitation of this vulnerability can lead to remote code execution on the Langflow host, allowing attackers to perform unauthorized actions and potentially compromise the system.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground.
As a temporary measure, disable auto-login by setting LANGFLOW_AUTO_LOGIN=false and restrict access to trusted users only.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
