P.K. Sharma (@_pksharma) on X

What it is

Two separate Langflow advisories cover MCP Stdio command execution, with different affected ranges and different fixes. The thread's point is that "we updated to 1.9.0" does not close both.

• CVE-2026-105740 / GHSA-7w94-79vh-5mr2: lists 1.8.3 as affected and 1.9.0 as fixed. It is an authenticated non-admin path. MCP Stdio commands run as the Langflow process user when the server is connected or listed.
• CVE-2026-105697 / GHSA-w794-rj3p-xv45: lists 1.1.2 up to but excluding 1.10.3, fixed in 1.10.3. It also lists fixes for the separate lfx and langflow-base packages.

How it works

The earlier validation covered only REST configuration. The broader advisory describes embedded flow and tweak routes that could still reach the process-launch boundary. The 1.10.3 fix adds validation at the API, flow and pre-spawn boundaries and removes the shell wrapper.

Preconditions / Affected

• Anyone on a version below 1.10.3, including 1.9.0, is covered by the broader advisory. The thread presents 1.9.0 as insufficient.
• Check the package you actually deploy (langflow, lfx or langflow-base), since each has its own fixed version.
• With LANGFLOW_AUTO_LOGIN=true on an exposed instance, the broader advisory says a token can be obtained without credentials.
• Disabling auto-login does not remove the authenticated non-admin path.

What to do

The thread gives no commands, only these actions:

1. Verify the patched version of each relevant package.
2. Restrict exposure and review the auto-login setting.
3. Inspect stored MCP configurations and imported flows.
4. Investigate unexpected child processes and outbound connections.
5. Preserve logs if compromise is suspected.

Patching closes a vulnerable path but does not remove a foothold established earlier.

Caveats

• The telemetry comes from one sensor: 1,628 attempts from 28 source IPs, first seen 19 September, in a snapshot preserved on 15 October.
• These are attempts, not confirmed victims.
• Source IPs are not a count of operators.
• One sensor does not measure worldwide prevalence.
• Telemetry tied to one CVE does not prove exploitation of the other.
• The full advisory comparison and checklist are on the author's linked site, not in the thread.