Six Langflow MCP Vulnerabilities: Authentication, Commands and Host Boundaries

Six MCP security boundaries

IBM lists Langflow OSS 1.0.0 through 1.10.3 as affected and directs users to 1.11.0 or later. The six CVEs cover an OAuth-path authentication bypass in MCP Composer, a localhost restriction bypass, two command-injection paths, dangerous Docker volume and device mappings, and incomplete configuration validation.

Authentication and localhost controls

CVE-2026-8446 affects MCP Composer when it is enabled and a project uses OAuth. CVE-2026-9077 lets an authenticated user bypass localhost-only restrictions and export arbitrary MCP server configuration to an IDE. Inventory public Composer routes, project authentication, proxy exceptions and user privileges before upgrade.

Command and host boundaries

CVE-2026-17623 and CVE-2026-17625 cover command injection through different privilege paths. CVE-2026-17626 exposes the host through dangerous Docker mounts or devices, while CVE-2026-17630 reflects incomplete configuration validation. Review existing server definitions, child processes, Docker API use and host paths without executing suspicious values.

Upgrade and validate

Back up the database and export MCP definitions and roles, then upgrade every instance to Langflow 1.11.0 or later. Verify Composer authentication, localhost restrictions, command-field rejection, Docker mount controls and high-privilege configuration checks. Also test approved MCP servers, IDE integration, task execution and logging.

Long-term controls

Maintain an approved MCP server catalog, avoid shell-string execution, isolate Docker sockets and hostPath mounts, and use individual administrative accounts. Correlate application audit logs with container-runtime and host process records so future configuration-boundary changes can be investigated quickly.