Langflow CVE-2026-105697

Exploitation requires the ability to reach the MCP server settings - Settings → MCP Servers → Add MCP Server, i.e. POST/PATCH /api/v2/mcp/servers/{server_name} - or to build a flow using the MCP Tools component, because there was no allowlist on the stdio command/args (and before 1.10.3 commands were wrapped in bash -c "exec ..."). The command executes automatically whenever Langflow attempts to connect to the configured server (listing servers, loading tools, or running the flow). The key access condition is the configuration mode: with the DEFAULT LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login returns a token with no credentials, so on an exposed default instance no account is needed. Limiting factors: if AUTO_LOGIN is disabled (documented as the production-recommended setting), any authenticated non-admin user is still sufficient (no admin role required), and the attacker must have network reachability to the Langflow API; successful code execution runs with the privileges of the Langflow process user. Fixed by the command allowlist/validation in 1.10.3.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes network-reachable, low-complexity OS command execution with scope change and full confidentiality/integrity/availability impact - consistent with the CWE-78 command-injection root cause confirmed by the GitHub advisory GHSA-w794-rj3p-xv45 and the fix commits/PRs. The most important signal is a configuration nuance the base CVSS vector understates: the vector lists PR:L (authenticated), but the description states that with the DEFAULT LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login issues a token with no credentials, so an internet-exposed default instance is effectively exploitable with PR:N (unauthenticated). With AUTO_LOGIN disabled, any authenticated non-admin user suffices. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponized exploit code at this time; the available 'source code evidence' is the vendor fix (allowlist/validation) rather than an attack POC. Net: treat as urgent patching priority given trivial exploitation against default configs, while noting that real-world exploitation prevalence is currently unverified (no EPSS/KEV supplied).

An attacker reaches an internet-exposed Langflow instance running the default LANGFLOW_AUTO_LOGIN=true, calls GET /api/v1/auto_login to obtain a token without credentials, then POSTs to /api/v2/mcp/servers/{server_name} an MCP 'server' whose command is an arbitrary OS command (e.g., a reverse shell or rm -rf). As soon as Langflow tries to connect to that server - listing servers, loading tools, or running the flow - the command executes on the host as the Langflow process user, even if the UI reports that the stdio server failed to start. No public exploit code was identified at time of analysis.