CVE-2026-105697

Executive Summary

CVE-2026-105697 is an OS command injection vulnerability (CWE-78) in Langflow, a framework for building and deploying AI-powered agents and workflows, affecting versions prior to 1.10.3. The MCP stdio transport launched arbitrary user-supplied commands and arguments from MCP server configuration without an allowlist, and (before 1.10.3) wrapped execution in bash -c "exec {command} ...". Any user able to reach the MCP server settings or build a flow with the MCP Tools component can execute arbitrary OS commands on the Langflow host as the Langflow process user. On exposed instances running the documented development-only LANGFLOW_AUTO_LOGIN=true default, GET /api/v1/auto_login issues a token without credentials, making the vulnerability reachable unauthenticated with a 9.9 CVSS score.

Technical Analysis

Langflow exposes the Model Context Protocol (MCP) server configuration through the user interface path "Settings → MCP Servers → Add MCP Server", backed by the API endpoints POST/PATCH /api/v2/mcp/servers/{server_name}. The MCP stdio transport mechanism was implemented such that the command and args fields of an MCP server configuration were passed directly to process execution. Critically:

1. No allowlist: There was no validation restricting which executables or arguments could be supplied. Any arbitrary OS command string (touch, rm -rf, a reverse shell binary, etc.) was acceptable as the command value.
2. Shell wrapping: Before version 1.10.3, the command was wrapped in bash -c "exec {command} ...", which means the supplied string was interpreted by the shell. This removed any residual barrier between a "command argument" and full shell metacharacter injection — pipes, subshells, redirection, and command chaining all become available.
3. Lazy but unconditional execution: The command is executed on the Langflow host as soon as Langflow attempts to connect to the configured server — triggered by listing servers, loading tools, or running a flow. Notably, the description states execution occurs "even when the UI then reports that the stdio server failed to start", meaning a failed server start is not evidence of failed command execution and does not mitigate the attack.

The attack surface is therefore any code path that reaches MCP server connection logic: the settings UI, the MCP server REST API, and flow execution using the MCP Tools component. The vulnerability class is classic CWE-78 command injection where the injection point is a configuration field consumed by a process-spawning function.

Authentication context matters for exposure: with LANGFLOW_AUTO_LOGIN=true (documented as development-only, but present as a default configuration), GET /api/v1/auto_login returns a token without any credentials. With auto-login disabled, the attacker must be authenticated, but any non-admin authenticated user can exploit the flaw — there is no privilege barrier beyond authentication itself, which is why the CVSS vector is PR:L (Low privileges required) with S:C (Scope Changed), reflecting that the vulnerable component (Langflow API) grants execution impact on the host OS, outside its own security scope.

Exploitation Scenarios

No public PoC or Nuclei template exists for this CVE; the chain below is derived directly from the NVD description and the command-injection vulnerability class.

1) Reconnaissance / target identification. The attacker identifies an internet-exposed Langflow instance, for example via HTTP title/body fingerprint matching ("Langflow") or by locating default-port deployments. The attacker then probes GET /api/v1/auto_login to determine whether the instance runs the default LANGFLOW_AUTO_LOGIN=true configuration. A successful token response confirms unauthenticated reachability of the API surface; a rejection indicates the attacker needs valid credentials for a non-admin account.

2) Triggering the flaw. Using the obtained token (or a legitimate non-admin account), the attacker submits an MCP server configuration through POST /api/v2/mcp/servers/{server_name} (equivalently via the "Settings → MCP Servers → Add MCP Server" UI). The command and/or args values contain the attacker-chosen OS command. Because there is no allowlist and, prior to 1.10.3, the invocation is wrapped in bash -c "exec {command} ...", shell metacharacters and command chaining are accepted. Alternatively, the attacker builds a flow containing the MCP Tools component referencing the malicious server.

3) Payload execution. The command executes on the Langflow host as the Langflow process user as soon as Langflow attempts to connect to the configured MCP server — for example when servers are listed, when tools are loaded, or when the flow is run. The described command space includes filesystem-impact commands (touch, rm -rf) and reverse shells. The attacker must account for the fact that the UI may report the stdio server as having "failed to start" while the command has in fact already executed; this is expected behavior and does not indicate failure of the payload.

4) Post-exploitation impact. With arbitrary command execution as the Langflow process user, the attacker can read and exfiltrate application data (including flow definitions and credentials/tokens accessible to the process), modify or destroy data, establish persistence through reverse shells or scheduled execution, and pivot to other network-reachable services. Where the Langflow process runs with elevated filesystem or container permissions, the blast radius extends to the container and potentially the host.

Impact Assessment

The CVSS 3.1 base score is 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Each metric maps directly to the described behavior:

• AV:N (Network) — the flaw is reachable over the network through the Langflow HTTP API and UI.
• AC:L (Low) — no special conditions or races; a configuration submission followed by normal server-connection activity triggers execution.
• PR:L (Low) — any authenticated non-admin user qualifies; with default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login effectively removes even this barrier on exposed instances.
• UI:N (None) — no victim interaction is needed beyond the application's own routine MCP connection attempts.
• S:C (Changed) — impact crosses from the Langflow application scope into the underlying operating system, executing commands as the Langflow process user.
• C:H/I:H/A:H — full compromise of confidentiality, integrity, and availability of data accessible to that process.

Business impact: Langflow instances are frequently deployed to orchestrate AI agents and workflows, meaning the compromised process may hold API keys, model provider credentials, database connection strings, and proprietary workflow logic. Command execution enables data theft, sabotage of AI pipelines, and use of the host as a pivot point into adjacent infrastructure. Because execution occurs even when the stdio server is reported as failed to start, operators may miss the compromise during routine troubleshooting.

Blast radius: Determined by (a) network exposure of the Langflow instance, (b) whether LANGFLOW_AUTO_LOGIN is enabled, and (c) the privileges of the Langflow process user/container. Internet-exposed instances with default auto-login configuration constitute the highest-risk cohort. CISA KEV status is NO, and no EPSS score has yet been published by FIRST.org; no public exploit code is known.

Detection Guidance

Sigma Rule

title: Langflow MCP Server Configuration Command Injection Attempt
id: 8f2c1d6e-4b7a-4c9e-9e21-3a5f7c1b9d42
status: experimental
description: Detects creation or modification of Langflow MCP server configurations via the API, the injection vector for CVE-2026-105697 (arbitrary command execution via MCP stdio transport).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105697
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PATCH'
  selection_uri:
    cs-uri-stem|contains: '/api/v2/mcp/servers/'
  selection_autologin:
    cs-uri-stem|contains: '/api/v1/auto_login'
  condition: selection_method and selection_uri or selection_autologin
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative configuration of MCP servers
level: high

YARA Rule

rule CVE_2026_105697_Langflow_MCP_Command_Injection
{
    meta:
        description = "Detects Langflow MCP server configuration payloads abusing the stdio transport command field (CVE-2026-105697)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105697"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $mcp_ep   = "/api/v2/mcp/servers/" ascii nocase
        $auto_ep  = "/api/v1/auto_login" ascii nocase
        $bashwrap = "bash -c \"exec" ascii nocase
        $cmd1     = "rm -rf" ascii nocase
        $cmd2     = "reverse shell" ascii nocase
        $mcp_tool = "MCP Tools" ascii nocase
        $stdio    = "stdio" ascii nocase

    condition:
        uint16(0) == 0x0A0D or
        ($mcp_ep and ($bashwrap or $cmd1 or $cmd2 or $stdio)) or
        ($auto_ep and $mcp_tool)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105697 Langflow MCP Server Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v2/mcp/servers/"; http.request_body; content:"command"; nocase; distance:0; reference:cve,2026-105697; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105697; classtype:attempted-admin; sid:2026105697; rev:1;)

alert http any any -> any any (msg:"CVE-2026-105697 Langflow Unauthenticated Auto-Login Token Retrieval"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/auto_login"; reference:cve,2026-105697; classtype:attempted-recon; sid:2026105698; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" and url.path == "/api/v1/auto_login" ]
  [ network where http.request.method in ("POST", "PATCH") and url.path : "/api/v2/mcp/servers/*" ]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, url, cs_uri_stem)
| eval method = upper(coalesce(method, http_method, cs_method))
| where (method IN ("POST","PATCH") AND like(uri, "%/api/v2/mcp/servers/%"))
      OR (method="GET" AND like(uri, "%/api/v1/auto_login%"))
| stats count values(uri) as uris values(method) as methods by src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="langflow,cve-2026-105697,">
  <rule id="2026105" level="12">
    <if_sid>31100</if_sid>
    <field name="url">/api/v2/mcp/servers/</field>
    <description>CVE-2026-105697: Langflow MCP server configuration request (potential command injection)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105697,command_injection,</group>
  </rule>

  <rule id="2026106" level="10">
    <if_sid>31100</if_sid>
    <field name="url">/api/v1/auto_login</field>
    <description>CVE-2026-105697: Langflow unauthenticated auto-login token request (exposure indicator)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105697,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable LANGFLOW_AUTO_LOGIN and ensure the instance is not running the development-only default configuration. This does not eliminate the flaw but removes unauthenticated reachability; note that any authenticated non-admin user can still exploit the issue.
   • Restrict network access to the Langflow API and UI (settings paths such as "Settings → MCP Servers") to trusted administrative networks only; do not expose Langflow directly to the internet.
   • Treat the MCP Tools component as a privileged feature; limit which users can create or modify flows that include it.
   • Do not rely on a "stdio server failed to start" UI message as evidence that a supplied command did not execute — the description states execution happens regardless.

2. Patch/upgrade steps

   • Upgrade to Langflow 1.10.3 or later. Where the base package is installed independently, upgrade langflow-base to 0.10.3 or later, and upgrade lfx to 1.10.3 or later.
   • After upgrading, verify that the MCP stdio transport no longer shell-wraps commands (the pre-1.10.3 bash -c "exec {command} ..." behavior must be gone) and that an allowlist or equivalent restriction governs executable selection.
   • Rotate any credentials, API keys, or tokens accessible to the Langflow process user if the instance may have been exposed, since pre-patch exploitation permits full read access.

3. Long-term hardening

   • Run Langflow with a least-privilege service account and in a constrained container with a read-only root filesystem and no unnecessary host mounts.
   • Enforce authentication and RBAC by default in all deployment templates; eliminate development-only flags such as auto-login from any shared or reachable configuration.
   • Apply egress filtering to limit the usefulness of reverse-shell payloads and monitor outbound connections from Langflow hosts.
   • Monitor the MCP server configuration endpoints and auto-login endpoint as high-signal security telemetry (see detection rules above).

References

• NVD — CVE-2026-105697: https://nvd.nist.gov/vuln/detail/CVE-2026-105697
• Langflow project (vendor product documentation and release notes for 1.10.3 / langflow-base 0.10.3 / lfx 1.10.3): https://www.langflow.org/
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Model Context Protocol (MCP) specification — stdio transport: https://modelcontextprotocol.io/

No threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-105697 at the time of writing; CISA KEV status is NO, no public PoC or exploit code is known, and no EPSS score has been published by FIRST.org.