Langflow Advisory Batch: Arbitrary Commands in MCP stdio Server Configs, PythonREPL to Superuser, and Cross-User MCP Resource Reads (CVE-2026-105697)

Langflow (`langflow`, `langflow-base`, `lfx` on PyPI)

Langflow published a set of advisories on October 5-7, 2026. Any user able to add an MCP server or build a flow with the MCP Tools component could set an arbitrary stdio command, run through `bash -c` as the Langflow user as soon as Langflow connects, even when the UI shows a failure; with the default `LANGFLOW_AUTO_LOGIN=true` no account is needed (CVE-2026-105697, affects 1.1.2 to before 1.10.3). `PythonREPLComponent` left `__builtins__` unrestricted, giving authenticated users RCE and the ability to set `is_superuser` (CVE-2026-10561, fixed in 1.10.1). Project-scoped MCP `resources/read` never checked flow ownership, letting one user read another's files (CVE-2026-105699, 1.6.8 to 1.9.0, fixed in 1.9.1). Single source (GitHub advisories and NVD)

MCP server definitions are treated as trusted executables that any flow author can supply, and MCP resource handlers are not scoped to the caller