Posts tagged #Langflow

Langflow's MCP Server Setup Let Any User Run OS Commands on the Host: CVE-2026-105697 Patch Guide

CVE-2026-105697 (CVSS 9.9): Langflow's MCP stdio transport executed any command in the server config — unauthenticated on defaults. Patch to 1.10.3.