Tools AI Risk Radar ai-incident-0142
Incident record
Langflow fixes command execution through MCP settings
- Severity
- Critical
- Status
- In the wild
- Type
- Infra Vuln
- Target
- langflow, langflow-base, lfx
- Actor
- researcher
- CVE
- CVE-2026-105697
What happened
A user able to configure an MCP server or build an MCP Tools flow could make the Langflow host run an arbitrary command. An exposed installation using development auto-login could grant access without an account; other configurations required an authenticated user.
Langflow fixed the REST configuration path in 1.9.0 and completed shared execution-path validation in 1.10.3. The broader advisory also lists langflow-base 0.10.3 and lfx 1.10.3 as fixed versions. The earlier maintainer advisory was published on 10 September; the broader follow-up was published on 28 September. Related CVEs are CVE-2026-105697 and CVE-2026-105740. In its record checked on 20 October, Previdian dates the first sensor-observed attempts against CVE-2026-105740 to 19 September and the latest to 20 October. Those observations measure attempts against sensors, rather than successful compromises of ordinary production systems.
Sources
- Primary disclosuregithub.com/langflow-ai/langflow/security/advisories/GHSA-w79…
- Earlier maintainer advisory, same REST vectorgithub.com/langflow-ai/langflow/security/advisories/GHSA-7w9…
- Previdian first-party sensor evidenceprevidian.com/CVE-2026-105740
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026