MCP Vulnerability Fixes: Langflow, MCP SDK and Claude Code

Last updated: 26 October 2026. Sources are listed at the end.

October 2026 brought a cluster of security fixes for the tools developers use to build AI agents. The most serious MCP vulnerability sits in Langflow, the visual agent builder. CVE-2026-105740 (CVSS 9.9) lets any logged-in user run shell commands on the server. They only need to add a Model Context Protocol (MCP) server. Honeypot operators have also recorded exploitation attempts since September.

The official MCP TypeScript SDK shipped two security releases as well. Its main MCP vulnerability, CVE-2026-104850, is fixed in 1.31.0. Here, a malicious MCP server could collect OAuth refresh tokens and client secrets. Then version 1.32.0 closed four more advisories. In addition, Anthropic published CVE-2026-86063 for a Claude Code plugin pinning bypass. Researchers also disclosed three critical wallet-drain bugs in the x402 payment SDKs.

This guide is for teams that run Langflow, build MCP clients or servers in Node.js, use Claude Code plugins, or let agents pay for APIs. Most fixes are already out. In fact, some have been available for months, so the main job is checking versions.

The short answer

• Langflow: upgrade to 1.10.3 or later (the current release on PyPI is 1.13.0). Also set LANGFLOW_AUTO_LOGIN=false and keep Langflow off the public internet.
• MCP TypeScript SDK: upgrade @modelcontextprotocol/sdk to 1.32.0 or later (1.32.2 is current). On the v2 packages, use client 2.2.0+ and server 2.3.0+.
• Claude Code: run claude --version and confirm 2.1.179 or later. Auto-update users already have the fix.
• x402: move the @x402/* packages to 2.23.0 or later, and keep the default spend controls switched on.
• Exposed old Langflow? Treat the host as possibly compromised and rotate every secret it held.

Timeline: what happened and when

Secondary trackers date some of these items a week later than the advisories do. We use the advisory, CVE and package-registry dates below.

The Langflow MCP vulnerability (CVE-2026-105740)

Langflow lets users add MCP servers that use the “stdio” transport. In practice, that means Langflow starts a local program and talks to it. Before the fix, Langflow passed the user’s command field straight into bash -c with no allowlist, validation or sandbox. The env field also accepted variables such as LD_PRELOAD or PATH. As a result, any account, including a non-admin one, could run commands as the Langflow process user.

The command runs whenever Langflow loads the server list, for example when someone opens the MCP settings page. So a malicious entry also works as a persistent backdoor that fires again for other users and admins.

There are two related advisories, and the version numbers matter:

• GHSA-7w94-79vh-5mr2 / CVE-2026-105740: fixed in 1.9.0, which added an allowlist on the “Add MCP Server” API route.
• GHSA-w794-rj3p-xv45 / CVE-2026-105697: the same class of bug through other paths, such as configs embedded in flows. Langflow fixed it fully in 1.10.3, which also removed the bash -c wrapper.

Default settings make this worse. With LANGFLOW_AUTO_LOGIN=true, the /api/v1/auto_login endpoint hands out a token without credentials. Therefore an exposed instance on defaults needs no account at all.

Exploitation status. The Hacker News reported on 15 October that Previdian’s honeypots logged 1,706 attempts from 28 IP addresses, starting on 19 September. Observed payloads tried to read LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD. However, eSecurity Planet notes these are attempts against honeypots, not confirmed breaches of real systems. At the time of writing, OpenCVE’s record showed CVE-2026-105740 was not in CISA’s Known Exploited Vulnerabilities catalogue.

MCP vulnerability in the TypeScript SDK: token theft and four more fixes

CVE-2026-104850 (CVSS 7.5, fixed in 1.31.0). The SDK’s OAuth client let the MCP server choose which authorization server received its credentials. A malicious or compromised server could name its own authorization server. The client would then send it a stored refresh token and client secret without any user interaction. This only affects HTTP MCP clients that use an authProvider and connect to servers they do not fully trust. On 1.x there is no workaround except connecting only to trusted servers.

Version 1.32.0 then fixed four more advisories. Running npm audit against version 1.30.1 in our sandbox listed all five issues.

One detail is easy to miss. For the memory issue, upgrading alone is not enough. You also need to set the new maxToolInputElements option and consider a smaller body size limit. Meanwhile, stdio-only servers are not affected by that bug.

Claude Code plugin pin bypass (CVE-2026-86063)

Claude Code lets a plugin marketplace pin a plugin to a 40-character commit hash. The installer ran git checkout on that hash but never confirmed the result. So an attacker who controlled the plugin repository could create a branch with the same name as the reviewed hash. Git would then check out the attacker’s branch instead.

This is not an MCP vulnerability as such, but it hits the same agent tooling. Anthropic rates it High (CVSS 4.0 score 7.7). Exploitation needs a user to install the malicious plugin, and the host must allow hash-shaped branch names. The fix shipped in 2.1.179. Air Security’s Or Nevo Michrowski reported it, and we found no public reports of abuse.

x402 SDK wallet-drain bugs

x402 is an open standard for paying for API calls inside an HTTP request, now run by the x402 Foundation. On 22 October, security firm V12 reported 25 flaws, three of them critical:

1. The default clients had no spending cap, so a hostile API could request an agent’s whole token balance.
2. The TypeScript Solana facilitator accepted a token approval as if it were a payment.
3. Clients signed Sign-In-With-X login messages for other websites, which allowed login relaying.

According to The Hacker News, the foundation fixed all three in its 18 August releases but published no advisory and no CVE. Neither V12 nor the foundation reported attacks.

ChromaDB’s max-severity unauthenticated RCE (CVE-2026-45829) also appears in some October roundups. However, SC Media reported it on 20 May 2026, so it falls outside this guide.

Am I affected?

Use the table to see whether any MCP vulnerability or related flaw in this roundup reaches your systems.

First, check Langflow in the Python environment or container that runs it:

pip show langflow langflow-base lfx | grep -E '^(Name|Version)'
# Inside Docker (container name is an example; not tested by us):
docker exec langflow pip show langflow | grep '^Version'

Next, check every Node.js project, including transitive copies of the SDK:

npm ls @modelcontextprotocol/sdk --all
npm audit --omit=dev
# Scan all projects under a folder:
find ~/projects -name package-lock.json -not -path '*/node_modules/*' \
  -execdir npm ls @modelcontextprotocol/sdk --all \;

Finally, check Claude Code and x402:

claude --version
npm ls @x402/svm @x402/fetch @x402/axios @x402/extensions --all

How to fix it step by step

1. Upgrade Langflow. Run pip install -U langflow in its environment, or pull a current image. Then restart and re-run pip show.
2. Turn off auto-login. Set LANGFLOW_AUTO_LOGIN=false, and give accounts only to trusted users with strong passwords.
3. Keep Langflow private. Put it behind a VPN or an authenticating reverse proxy instead of a public IP.
4. Allowlist MCP packages. On 1.10.3+, Langflow’s npx and uvx allowlist still permits any package by default. Therefore set LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES to an exact list, and consider LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true.
5. Upgrade the MCP SDK. Run npm install @modelcontextprotocol/sdk@latest, commit the lockfile, and redeploy. For HTTP servers, also set maxToolInputElements.
6. Scope tokens. Give each MCP client its own OAuth client and narrow scopes. On v2 servers, check the token audience after upgrading.
7. Update Claude Code. Run claude update (from Anthropic’s docs). Afterwards, review installed plugins and remove any you do not recognise.
8. Set agent budgets. On x402, never set spendControls: false. Add per-payment and total limits, plus allowed tokens and recipients.

Was my Langflow server already compromised?

Of the issues here, only the Langflow MCP vulnerability has reported exploitation attempts. So if an old Langflow version faced the internet, check its logs before trusting it. Start with requests to the MCP server endpoints and to auto-login:

grep -E '"(POST|PATCH) /api/v2/mcp/servers/' access.log
grep -E '/api/v1/auto_login|/api/v2/mcp/servers' access.log \
  | awk '{print $1}' | sort | uniq -c | sort -rn

Then review the MCP servers saved in each project’s settings for commands you did not add. Previdian, as reported by The Hacker News, linked the IP 192.255.229[.]92 to environment-variable theft. The stolen data went to 146.70.211[.]112 on port 18764. Search your logs and firewall records for both. Also look for unexpected child processes of the Langflow service.

If you find signs of misuse, rotate LANGFLOW_SECRET_KEY, the superuser password and every API key stored in flows. In addition, rebuild the host rather than cleaning it. Also consider MCP clients on SDK 1.30.1 or earlier that may have met an untrusted server. For those, the advisory recommends rotating client secrets and revoking tokens.

India angle

We found no CERT-In advisory for these issues at the time of writing. However, Indian organisations covered by CERT-In’s April 2022 Directions must report qualifying incidents within six hours. A compromised Langflow server holding customer data could fall within that rule. Meanwhile, the DPDP Rule 7 breach-notice duty applies from May 2027, so it is not yet in force.

Quick checklist

• ☐ Langflow on 1.10.3 or later, ideally 1.13.0
• ☐ LANGFLOW_AUTO_LOGIN=false and no public exposure
• ☐ LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES set to an exact list
• ☐ @modelcontextprotocol/sdk 1.32.0+ in every project and lockfile
• ☐ maxToolInputElements set on HTTP MCP servers
• ☐ Claude Code 2.1.179+ and plugins reviewed
• ☐ x402 packages 2.23.0+ with spend limits on
• ☐ Logs checked for /api/v2/mcp/servers writes and the published IPs
• ☐ Secrets rotated on any exposed old Langflow host

Every MCP vulnerability above comes back to the same point: agent tools run code and hold tokens, so treat them like production servers. For the wider controls, see our AI agents and MCP servers security checklist, and read our LiteLLM compromise guide for secret rotation steps. If you want an outside team to test an exposed AI stack, our VAPT services cover it.

Sources

• Langflow advisory GHSA-7w94-79vh-5mr2 (GitHub)
• Langflow advisory GHSA-w794-rj3p-xv45 (GitHub)
• Langflow’s critical authenticated RCE under exploitation (The Hacker News)
• MCP TypeScript SDK advisory GHSA-6qxp-vccf-f47h (GitHub)
• MCP TypeScript SDK advisory GHSA-22jm-h49p-29qw (GitHub Advisory Database)
• CVE-2026-111769 for @modelcontextprotocol/sdk (GitLab Advisory Database)
• Claude Code advisory GHSA-pq7j-f95f-qfcv (GitHub)
• Critical x402 SDK flaws could drain AI agent balances (The Hacker News)

Want a second pair of eyes on your DevOps security? Our VAPT services cover CI/CD pipelines, self-hosted tools and how secrets are stored. For servers, see our Linux server hardening & security audit, or contact us.