LLM frameworks · Langflow
Langflow
Visual builder for AI agents and workflows, with MCP support.
3Advisories
3critical
0high
0medium
2026-10-06Latest
Timeline · advisories per quarter
32026 Q4
Named in sources
Reported for Langflow
01. CVE-2026-10561: Langflow's Python Interpreter component ran code with no real sandboxBefore 1.10.1, any logged-in Langflow user who could edit and run a flow could use the Python Interpreter component to run OS commands as the Langflow service and make their own account a superuser. Langflow 2026-10-06 02. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow 
MCP SDKs & servers 2026-10-05 03. CVE-2026-8505: Langflow webhooks let anyone run a flow without an API keyIn Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution. Langflow 2026-10-05
Langflow 2026-10-06 02. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow MCP SDKs & servers 2026-10-05 03. CVE-2026-8505: Langflow webhooks let anyone run a flow without an API keyIn Langflow 1.7.0 through 1.9.0, webhook endpoints skipped API key checks by default, so anyone who knew a flow's UUID could run it as the flow's owner. Flows that run Python code turn that into remote code execution. Langflow 2026-10-05