DIGGINGBEAGLE

Case · DiggingBeagle record

Langflow MCP server settings could execute commands on the host

Unvalidated MCP stdio command settings reached process execution in Langflow; a partial API fix left flow-embedded configurations vulnerable until 1.10.3.

Scope

CVE-2026-105697 in Langflow MCP stdio integrations, described in the GitHub-reviewed advisory published September 28 and updated October 9, 2026. This is a disclosed code-execution vulnerability, not a verified in-the-wild intrusion.

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
Evidence
Grade B
Remediation
patch available
AI role
AGAINST AI
Basis and provenance

The first-party GitHub advisory provides a reproducible command-execution PoC and a specific versioned fix at the actual process-spawn sink. It also identifies remaining package-execution trust boundaries in otherwise patched deployments. There is no independently established production compromise count.

Assessed Oct 11, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-LANGFLOW-MCP-UNVALIDATED-COMMAND · CLM-LANGFLOW-MCP-VERSION-RANGES · CLM-LANGFLOW-POSTPATCH-PACKAGE-TRUST · GHSA-w794-rj3p-xv45: Langflow MCP stdio command execution

At a glance

Mechanism and trust boundary

  1. 01

    MCP stdio configuration becomes editable

    A user or client with relevant settings or flow access supplies a command and arguments for an MCP server.

    Boundary: user or flow input to server configuration

  2. 02

    Server initiates connection

    Langflow attempts to start the declared stdio server and passes the parameters to the process launcher.

    Boundary: configuration to local operating system process

  3. 03

    Partial input check misses a path

    REST validation added in 1.9.0 did not cover configurations embedded in flows or runtime tweaks.

    Boundary: validated API model versus actual execution sink

  4. 04

    Validation moves to the sink

    Version 1.10.3 enforces validation immediately before starting the process.

    Boundary: enforced spawn policy

Claims & evidence

CLM-LANGFLOW-MCP-API-FIX-BYPASSThe version 1.9.0 REST-model validation did not validate executable commands embedded in flow configurations or tweaks; the advisory says 1.10.3 applies validation at the execution sink and removes bash -c.supported

Basis: reported finding

Link to claim
CLM-LANGFLOW-MCP-VERSION-RANGESThe advisory marks langflow versions 1.1.2 through 1.10.2, langflow-base versions 0.1.2 through 0.10.2 and lfx versions before 1.10.3 as affected, with the listed component-specific patched versions.supported

Basis: reported finding

Link to claim
CLM-LANGFLOW-MCP-UNVALIDATED-COMMANDThe Langflow advisory documents that MCP stdio server configurations could launch user-supplied commands and arguments on the Langflow host as the application process user when a client attempted to connect.supported

Basis: reported finding

Link to claim
CLM-LANGFLOW-POSTPATCH-PACKAGE-TRUSTThe Langflow advisory states that the 1.10.3 command allowlist still permits npx and uvx to invoke arbitrary packages by default, and recommends LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES plus interpreter and Docker hardening for multi-tenant deployments. This is an additional supply-chain exposure consideration, distinct from the fixed shell command injection.supported

Basis: reported finding

Link to claim
CLM-LANGFLOW-MCP-AUTOLOGIN-PRECONDITIONThe disclosed remote attack path depended on MCP configuration access; the advisory says exposed development instances with LANGFLOW_AUTO_LOGIN enabled could issue a token without normal login, while otherwise an authenticated non-admin user was required.supported

Basis: reported finding

Link to claim

Implications

Do not stop at filtering a settings form: validate the command, arguments and environment where a process is actually spawned, including serialized-flow and tweak paths. Upgrade affected Langflow, langflow-base and lfx components to their separately listed fixed versions. For shared deployments, narrow runnable package names and interpreter privileges even after patching the disclosed injection. A reproduced vulnerability and public exposure observations do not establish that the reported flaw was exploited against a specific named victim.

Controls and mitigations

  • Upgrade langflow to 1.10.3 or newer, langflow-base to 0.10.3 or newer and the corresponding fixed lfx component, verifying what is actually deployed.
  • Disable LANGFLOW_AUTO_LOGIN for exposed installations and limit MCP configuration privileges.
  • Where multiple users share the service, restrict package execution with LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES and evaluate LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING and LANGFLOW_MCP_SERVER_DOCKER_HARDENING.
  • Apply process-launch validation at every entry path, particularly embedded flow components and tweaks.

Unknowns and contradictions

  • The number of exposed and unpatched deployments has not been independently established.
  • The advisory gives a reproduction but does not establish confirmed criminal exploitation or named victims.
  • The complete set of nonstandard deployment configurations and forks affected by the bug has not been audited here.

Sources and citation

EvidenceGHSA-w794-rj3p-xv45: Langflow MCP stdio command execution

Material revision history

  1. Oct 11, 2026 · Published version · first publication · revision 132
Record metadata

Canonical ID: CASE-2026-LANGFLOW-MCP-STDIO-RCE · revision 132

Legacy date (semantics unspecified): 2026-09-28. This value is not treated as an occurrence or disclosure date.