CVE-2026-105697 | langflow-ai Langflow/langflow-base/lfx MCP Stdio Transport /api/v2/mcp/servers server_name/command os command injection

October 5, 2026 Yanac

A vulnerability categorized as critical has been discovered in langflow-ai Langflow, langflow-base and lfx. Affected by this vulnerability is an unknown functionality of the file /api/v2/mcp/servers of the component MCP Stdio Transport. The manipulation of the argument server_name/command results in os command injection.

This vulnerability is known as CVE-2026-105697. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More