Security Advisories
CVE-2026-105697: Langflow, MCP Servers, and the Risk of an Exposed AI Builder
Why a Langflow MCP setting amounts to command execution, how default auto-login widens the risk, and how to run AI workflow tools without handing over your server.
This independent write-up is not affiliated with the vendors named. Patch status reflects public advisories on the date shown, so confirm it against your vendor before acting.
CVE-2026-105697 is a command execution flaw in Langflow, a popular tool for building AI agents and workflows. Its MCP stdio transport launched whatever command a user entered in an MCP server configuration, with no allowlist. The command runs on the Langflow host as soon as Langflow tries to connect, even if the interface then reports that the server failed to start. It is rated 9.9 and fully fixed in Langflow 1.10.3.
A score that assumes a logged-in user can understate this. The advisory notes that with the default LANGFLOW_AUTO_LOGIN=true setting, an endpoint hands out a token without credentials. On an exposed instance running that default configuration, the flaw is reachable without an account.
Langflow also has a track record that deserves attention. CISA's catalog of known exploited vulnerabilities lists six Langflow flaws, most added during 2026, and more critical entries appeared throughout October. If your AI product runs on a Langflow instance reachable from the internet, treat this as urgent.
/01
How the flaw works
MCP, the Model Context Protocol, lets AI tools talk to external servers. One transport, stdio, works by starting a local process and communicating with it. So an MCP server configured over stdio is, by design, a command that the host will run. Before the fix, Langflow accepted that command from anyone able to reach the MCP server settings or build a flow with the MCP Tools component, and it wrapped the command in a shell.
CVE-2026-105740 describes the same weakness in versions before 1.9.0, and CISA's enrichment notes that proof-of-concept code exists for it. The 1.9.0 fix turned out to be partial: according to the advisory for CVE-2026-105697, embedded flow and tweak configurations stayed unvalidated through 1.10.2. If you upgraded to 1.9.0 back then and stopped, you are still affected.
/02
A wider cluster, and what to upgrade to
These two CVEs are not the end of it. IBM published a series of Langflow OSS bulletins in October describing code execution and authentication issues, some reaching through 1.12.8. Other entries, such as CVE-2026-51886, describe an authenticated route that accepts Python source and executes it. CVE records for these vary in detail, and IBM's bulletins are the best reference for that product line.
So do not aim for the minimum fixed version. As of November 4, the Langflow project marks 1.13.1 as its latest release, with 1.12.9 as a backport to the 1.12 line. Move to the latest release you can, and confirm the status of each bulletin that applies to your deployment.
/03
How to secure a Langflow instance
Upgrading handles the known bugs. The configuration below reduces the damage from the next one. Langflow exists to execute flows and custom components, so a user who can edit flows should be treated as someone who can run code on that machine. Access to the editor is effectively access to the server, and it should be controlled accordingly.
If an instance has been exposed to the internet with auto-login on, assume someone may have reached it. Review logs and processes, then rotate every credential it could read, including model provider keys, database passwords, and the secrets stored inside flows.
- Set LANGFLOW_AUTO_LOGIN=false. The advisory describes auto-login as a development-only setting.
- Do not expose the editor to the public internet. Put it behind a VPN or an authenticating proxy.
- Only give flow-editing access to people you would trust with shell access.
- Run Langflow in an isolated container or host, with no production database credentials on it.
- Restrict its outbound network access, and scope each model provider key to that one workload.
- Serve end users through a separate API layer you control, instead of exposing the builder itself.
/04
The broader MCP lesson
A stdio MCP server configuration is a command line, and any feature that lets someone set one is a code execution feature. The same class of problem appears elsewhere. The recent LiteLLM flaw, CVE-2026-114612, reaches command execution through its MCP stdio endpoint after an admin takeover, and the pattern is likely to recur as more products add MCP support.
If your own application lets users or models add MCP servers, apply the same scrutiny. Use an allowlist of approved servers, avoid passing user input into commands or environment variables, and do not run the host process with access it does not need. Assume that a model's output can be influenced by whatever content it has read.
/05
From prototype tool to production dependency
Langflow is a useful tool, and visual builders are a great way to get an AI idea working quickly. The risk comes when a prototype quietly becomes production. The instance someone set up on a VPS for a demo, with default settings and live API keys, is now serving customers. It was never hardened because it was never meant to last.
If you are at that point, you have a real product with a prototype's infrastructure. An experienced engineer can help you decide whether to keep the builder behind a proper boundary or move the logic into a maintained service, and can review what has been exposed along the way. We do this when productionizing AI-built applications, and we can stay involved through a retainer as these tools continue to change.
Frequently asked
Questions about this topic.
Which Langflow version fixes CVE-2026-105697?
Langflow 1.10.3 contains the full fix, and 1.9.0 was only partial. Later bulletins cover versions through 1.12.8, so upgrade to the latest release, which the project listed as 1.13.1 on November 4, 2026.
Does this require a login?
The advisory says that with the default LANGFLOW_AUTO_LOGIN=true, an endpoint hands out a token without credentials, so an exposed instance in that configuration is reachable without an account. With auto-login disabled, any authenticated non-admin user could still exploit it on a vulnerable version.
Has Langflow been exploited before?
Yes. CISA's Known Exploited Vulnerabilities catalog lists several Langflow flaws, beginning with CVE-2025-3248. CVE-2026-105697 itself was not listed as of November 4, 2026.
Sources