CVE-2026-105697: Langflow OS Command Injection Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-105697: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration. Affects langflow versions >= 1.1.2, < 1.10.3. Fixed in 1.10.3. How to fix ↓
Also tracked for
- langflow-base · PyPI
- lfx · PyPI
The same CVE-2026-105697 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Langflow is an open-source framework designed for building and managing machine learning workflows. It allows users to create flows using various components, including the MCP (Machine Control Protocol) server. The framework's flexibility and ease of use make it popular among developers. However, a critical vulnerability has been identified in versions prior to 1.10.3, where improper handling of user-supplied commands can lead to remote code execution (RCE).
Vulnerability Detail
Before version 1.10.3, Langflow's MCP stdio transport executed any command provided by the user in the MCP server configuration without proper validation. This lack of an allowlist allowed malicious users to inject arbitrary OS commands, which would run on the Langflow host as the process user. The vulnerability is exacerbated by the default setting of LANGFLOW_AUTO_LOGIN=true, which allows unauthenticated access to the API, making it easy for attackers to exploit the vulnerability without needing valid credentials. The vulnerability was fixed in two stages, with the final resolution implemented in version 1.10.3.
How To Fix
Latest published version: 1.14.0.dev2 as of 22 Oct 2026
pip install --upgrade "langflow==1.14.0.dev2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.3
This is the first release that contains the fix.
pip install --upgrade "langflow==1.10.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade to the patched version, set LANGFLOW_AUTO_LOGIN=false and avoid exposing Langflow to untrusted networks. Additionally, only provide Langflow accounts to trusted users.
Conclusion
The Langflow vulnerability CVE-2026-105697 poses a significant risk of remote code execution due to improper command handling. Users are strongly advised to upgrade to version 1.10.3 or later to mitigate this risk. If upgrading is not feasible, implementing the suggested workarounds can help reduce exposure to potential attacks.
See every vulnerability recorded for langflow →
FAQ
CVE-2026-105697 is a vulnerability in Langflow that allows remote code execution through OS command injection due to improper handling of user-supplied commands.
Langflow versions from 1.1.2 to 1.10.2 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate upgrade is not possible, implement the workarounds by disabling auto-login and restricting access to trusted users.
The CVSS score for this vulnerability is 9.9, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
