Tracking: CVE-2026-105697
Severity: Critical
Who is affected
The affected packages and first fixed releases are:
| Package | Affected versions | First fixed release |
|---|---|---|
langflow |
1.1.2 to before 1.10.3 | 1.10.3 |
langflow-base |
0.1.2 to before 0.10.3 | 0.10.3 |
lfx |
Before 1.10.3 | 1.10.3 |
With the default LANGFLOW_AUTO_LOGIN=true, a caller can obtain a token without supplying credentials. Disabling auto-login still leaves the reported path reachable to authenticated non-admin users.
How the attack works
MCP settings, flow execution, or execution tweaks can supply a stdio server command and arguments. A bash -c wrapper interprets that input as shell code. Execution happens before the MCP handshake, so a failed connection is not evidence that nothing ran.
The 1.9.0 API allowlist was a partial mitigation. The complete fix validates the execution path and starts the process directly.
What to do
- Upgrade every applicable package to the fixed release or later, then restart affected services.
- Disable unnecessary auto-login and review saved MCP commands, flow settings, and execution tweaks.
- Investigate unexpected child processes and failed MCP starts. Assess service credentials if suspicious execution occurred.