Langflow CVE-2026-105697: MCP stdio configuration could execute commands

CVE-2026-105697, published on October 5, describes critical command execution in Langflow through MCP stdio server configuration. Commands run with the Langflow process’s permissions. An accessible instance using the default LANGFLOW_AUTO_LOGIN=true can be reached without an account; disabling that option does not remove the vector available to an authenticated user.

Breachroad recommends identifying who can create MCP configurations and flows, and what the application account can access. Then connect the update to the packages actually running. Integration configuration needs careful treatment when it can cause an operating-system process to start.

Check three packages, not just the product name

The project advisory lists the following affected and fixed versions:

Package	Affected versions	Fixed version
langflow	from 1.1.2 to before 1.10.3	1.10.3
langflow-base	from 0.1.2 to before 0.10.3	0.10.3
lfx	before 1.10.3	1.10.3

The advisory also explains that the control added in 1.9.0 did not cover every execution path. Configurations embedded in flows could bypass REST-model validation. Rejecting an invalid configuration in one form therefore did not establish that the issue had been removed.

Our proposal is to record dependencies for the deployed instance and, for containers, the image identifier. Verification should include running replicas and environments maintained outside the main publication process. Give each exception a named owner so that a forgotten test instance does not remain outside the update plan.

What changed at the execution boundary

Change #14036 introduces a shared policy for API configurations, configurations embedded in flows and the process-launch boundary. Release 1.10.3 includes that fix.

Breachroad’s conclusion for AI integration teams is that validation should also accompany the operation that actually launches a tool. An import, saved flow or alternate interface should not lead to privileged execution merely because it avoided the configuration screen.

In an architecture review, mark the point where user-supplied data becomes a system action. Consider permission to edit configuration, run a flow and approve a new integration separately. Someone using an existing assistant does not necessarily need all three permissions. Making these decisions explicit gives administrators a clearer basis for access reviews and incident handling.

Review exposure and the process account

We suggest verifying login settings and network access to the instance. An environment used to create flows should have defined users and an administrator. Access to integration configuration needs a deliberate decision from the service owner, especially where several teams share an instance.

Review secrets, directories, volumes and services reachable by the Langflow account as well. Minimal permissions limit the consequences of tool failures. Record who approves packages and configuration changes, and how quickly an unwanted integration can be disconnected. Keep that procedure accessible to the people supporting the service.

If you suspect unauthorised execution, preserve configuration and process evidence, involve the incident-response team and assess the credentials available to the account. Our operational recommendation is to connect interface messages with process-activity records before closing the assessment of an event.

A scenario to discuss with the organisation

Imagine a shared instance where employees add integrations to their own assistants. In an illustrative process, the team lead limits configuration editing to a designated group, the administrator confirms corrected dependencies and the security team documents the application account’s access. Users know where to propose an MCP server and who approves its use.

This is Breachroad’s proposal, rather than a reported attack. Our MCP security guide provides further context. Through cybersecurity and secure AI training for organisations, teams can practise integration approval, permission assessment and responding to unexpected tool behaviour.