Skip to content
AgentProv

2026-10-07 · 2026-Q4

Langflow Advisory Batch: Arbitrary Commands in MCP stdio Server Configs, PythonREPL to Superuser, and Cross-User MCP Resource Reads (CVE-2026-105697)

Primary layerL5 ConfigSecondary:L6 Identity / Run

Who wrote the file that runs on open?

The question layer 5 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

Langflow (`langflow`, `langflow-base`, `lfx` on PyPI)

Impact

Langflow published a set of advisories on October 5-7, 2026. Any user able to add an MCP server or build a flow with the MCP Tools component could set an arbitrary stdio command, run through `bash -c` as the Langflow user as soon as Langflow connects, even when the UI shows a failure; with the default `LANGFLOW_AUTO_LOGIN=true` no account is needed (CVE-2026-105697, affects 1.1.2 to before 1.10.3). `PythonREPLComponent` left `__builtins__` unrestricted, giving authenticated users RCE and the ability to set `is_superuser` (CVE-2026-10561, fixed in 1.10.1). Project-scoped MCP `resources/read` never checked flow ownership, letting one user read another's files (CVE-2026-105699, 1.6.8 to 1.9.0, fixed in 1.9.1). Single source (GitHub advisories and NVD)

Root cause

MCP server definitions are treated as trusted executables that any flow author can supply, and MCP resource handlers are not scoped to the caller

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Langflow Advisory Batch: Arbitrary Commands in MCP stdio Server Configs, PythonREPL to Superuser, and Cross-User MCP Resource Reads (CVE-2026-105697) (2026-10-07). https://agentprov.com/incidents/2026-10-07-langflow-advisory-batch-arbitrary-commands-in-mcp-stdio-server-configs

Related