ENDOR-VUL-2026-2601

Description: When an MCP stdio server is configured through /api/v2/mcp/servers, Langflow assembles the command and its arguments into a single string with a plain string join and hands the result to bash -c. Flattening the argument vector into shell source means any argument value is shell source too, so a configured server entry executes arbitrary commands on the Langflow host at the point the server is launched. The trigger is indirect: the configuration is written once and fires later, which puts it on the wrong side of the trust boundary Langflow assumes for authenticated flow authors.

Impact: Command Execution, authenticated. Runs with the privileges of the Langflow service process.

The structural fix is to stop flattening: pass the command and the argument vector to StdioServerParameters directly rather than routing them through a shell.

GitHub Security Advisory GHSA-w794-rj3p-xv45 was assigned for this finding and is still not public as of 2026-08-24, so there is no advisory page to cite and no published CVSS score to quote. Reported 2026-01-26, with repeated attempts to reach the maintainer; the fix status is undetermined, because there is no way to observe from outside whether a patch has shipped. Disclosed at DEF CON 34 under a 90+30 day disclosure timeline. This record will be re-keyed to the GHSA when the advisory publishes. Full analysis is in the technical whitepaper.