CVE-2026-105697

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTO_LOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

• CWE-78

• https://github.com/langflow-ai/langflow/commit/eba285edf1dd4a33bf23a9cb8113c991fcdf3d1d
• https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0
• https://github.com/langflow-ai/langflow/pull/12290
• https://github.com/langflow-ai/langflow/pull/14036
• https://github.com/langflow-ai/langflow/releases/tag/v1.10.3
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105691Penpot is an open-source design and prototyping platform. Pr…9.9
• CVE-2026-105692Penpot is an open-source design and prototyping platform. Pr…5.4
• CVE-2026-105693Penpot is an open-source design and prototyping platform. Pr…5.3
• CVE-2026-105694Penpot is an open-source design and prototyping platform. Pr…5.4
• CVE-2026-105695Penpot is an open-source design and prototyping platform. Pr…5.9
• CVE-2026-105696Penpot is an open-source design and prototyping platform. Pr…6.5
• CVE-2026-105698Langflow is a tool for building and deploying AI-powered age…5.4
• CVE-2026-105699Langflow is a tool for building and deploying AI-powered age…7.1
• CVE-2026-10570The Sympl Repeater for ACF and Elementor plugin for WordPres…6.4
• CVE-2026-105701The ACPT (Premium) plugin for WordPress is vulnerable to Rem…8.8
• CVE-2026-105703A vulnerability was determined in PHPGurukul User Registrati…4.7
• CVE-2026-105704A vulnerability was identified in SourceCodester Drug Recomm…7.3