fix(security): consolidate release-1.10.3 hardening backports (#14071)

* fix(security): harden component code module access

* fix(security): protect Docling Serve requests

* fix(auth): verify current password on password changes

* fix(security): restrict MCP stdio package sources

* fix(security): confine AssemblyAI audio file access

* [autofix.ci] apply automated fixes

* fix(kb): enforce folder connector security settings

* fix(security): block native FFI imports in generated code

* fix: track module assignment aliases in code scanner

* fix(voice): enforce flow authorization on websocket

* fix(security): block MCP Docker host access

* fix(security): validate embedded MCP stdio configs

* fix: require executable-only MCP commands

* test: stub optional AssemblyAI dependency

* test: use allowed MCP commands in timeout tests

* fix(initial_setup): preserve variable bindings when loading flows from disk (#14053)

fix(initial_setup): preserve variable bindings on flow load

* fix(security): backport narrow tenant hardening

Backport the targeted security fixes from release-1.11.0, including public-flow secret scrubbing, tenant-scoped MCP caching, trusted custom-component builds, code-execution gating, environment fallback protection, and query/path/header hardening.

Source commits: 36c6d11 1f39a4b 331b637 2e7bfba 329f15f 359344b 3e3b70b 2f44a77 068c983 de0e232 8b473e4 a91b967 294effc b0a6350 9f15a60 79fca45

* fix(security): complete MCP tenant-isolation backport

* docs(security): describe release hardening controls

* fix(security): backport tenant isolation hardening

* fix(security): harden published image defaults

* fix(security): harden connector URLs against SSRF

* fix(security): address alias review findings

* fix(security): backport remaining hardening gaps

* fix(security): pin WebSearch result and RSS DNS

* fix(kb): enforce per-user path containment

* fix(security): complete release-1.10.3 hardening backport

* fix(security): harden AssemblyAI file submission

* fix: bind loop and comprehension aliases

* [autofix.ci] apply automated fixes

* fix(lfx): register code execution aliases

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: erichare

.github/workflows/typescript_test.yml

@@ -388,11 +388,20 @@ jobs:
           command: |
             cd src/frontend
             echo 'Running tests with pattern: ${{ needs.determine-test-suite.outputs.test_grep }}'
-            npx playwright test ${{ inputs.tests_folder }} ${{ needs.determine-test-suite.outputs.test_grep }} --shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --list --retries=3
+            TEST_LIST=$(npx playwright test ${{ inputs.tests_folder }} ${{ needs.determine-test-suite.outputs.test_grep }} --shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --list --retries=3)
+            echo "$TEST_LIST"
+
+            WORKERS=2
+            if printf '%s\n' "$TEST_LIST" | grep -Eq 'user-flow-state-cleanup\.spec\.ts|user-progress-track\.spec\.ts'; then
+              # These user/session tests share one SQLite-backed server and mutate
+              # authentication state, so running them concurrently corrupts the
+              # session and can leave both pages back on the sign-in screen.
+              WORKERS=1
+            fi
             # echo command before running
-            echo "npx playwright test ${{ inputs.tests_folder }} ${{ needs.determine-test-suite.outputs.test_grep }} --trace on --shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --workers 2 --retries=3"
+            echo "npx playwright test ${{ inputs.tests_folder }} ${{ needs.determine-test-suite.outputs.test_grep }} --trace on --shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --workers $WORKERS --retries=3"
 
-            npx playwright test ${{ inputs.tests_folder }} ${{ needs.determine-test-suite.outputs.test_grep }} --trace on --shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --workers 2 --retries=3
+            npx playwright test ${{ inputs.tests_folder }} ${{ needs.determine-test-suite.outputs.test_grep }} --trace on --shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --workers "$WORKERS" --retries=3
 
       - name: Upload Test Results
         if: always()

.secrets.baseline

@@ -317,40 +317,16 @@
         "is_verified": false,
         "line_number": 645,
         "is_secret": true
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/backend/base/langflow/agentic/flows/SystemMessageGen.json",
-        "hashed_secret": "59416d210387d77a76c3c93f0fdcb89c08e42e6f",
-        "is_verified": false,
-        "line_number": 2324,
-        "is_secret": true
       }
     ],
     "src/backend/base/langflow/agentic/flows/TemplateAssistant.json": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/backend/base/langflow/agentic/flows/TemplateAssistant.json",
-        "hashed_secret": "d8b16a7764b2b6b2da9a15df8e4cca6b3bb16593",
-        "is_verified": false,
-        "line_number": 1134,
-        "is_secret": true
-      },
       {
         "type": "Hex High Entropy String",
         "filename": "src/backend/base/langflow/agentic/flows/TemplateAssistant.json",
         "hashed_secret": "05c44419f0be64056556f8c81c87e5d3bc7cd1f5",
         "is_verified": false,
         "line_number": 1927,
         "is_secret": true
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/backend/base/langflow/agentic/flows/TemplateAssistant.json",
-        "hashed_secret": "a7db96ddbe558c8ec7514abb20420e4fbdc50da5",
-        "is_verified": false,
-        "line_number": 2082,
-        "is_secret": true
       }
     ],
     "src/backend/base/langflow/agentic/flows/TranslationFlow.json": [
@@ -1529,7 +1505,7 @@
         "filename": "src/backend/tests/unit/api/v1/test_projects.py",
         "hashed_secret": "8bb6118f8fd6935ad0876a3be34a717d32708ffd",
         "is_verified": false,
-        "line_number": 1829,
+        "line_number": 1856,
         "is_secret": true
       }
     ],
@@ -1887,7 +1863,7 @@
         "filename": "src/backend/tests/unit/components/files_and_knowledge/test_file_component.py",
         "hashed_secret": "72cb70dbbafe97e5ea13ad88acd65d08389439b0",
         "is_verified": false,
-        "line_number": 603,
+        "line_number": 625,
         "is_secret": true
       }
     ],
@@ -7328,5 +7304,5 @@
       }
     ]
   },
-  "generated_at": "2026-07-13T18:14:58Z"
+  "generated_at": "2026-07-14T18:11:48Z"
 }

docker/build_and_push.Dockerfile

@@ -131,5 +131,12 @@ WORKDIR /app
 ENV LANGFLOW_HOST=0.0.0.0
 ENV LANGFLOW_PORT=7860
 ENV LANGFLOW_AUTO_LOGIN=false
+ENV LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
+ENV LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true
+ENV LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true
+ENV LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK=false
+ENV LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES=mcp-proxy,lfx
+ENV LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
+ENV LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true
 
 CMD ["langflow", "run"]

docker/build_and_push_backend.Dockerfile

@@ -112,5 +112,12 @@ WORKDIR /app
 ENV LANGFLOW_HOST=0.0.0.0
 ENV LANGFLOW_PORT=7860
 ENV LANGFLOW_AUTO_LOGIN=false
+ENV LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
+ENV LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true
+ENV LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true
+ENV LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK=false
+ENV LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES=mcp-proxy,lfx
+ENV LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
+ENV LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true
 
 CMD ["python", "-m", "langflow", "run", "--backend-only"]

docker/build_and_push_base.Dockerfile

@@ -135,5 +135,12 @@ WORKDIR /app
 ENV LANGFLOW_HOST=0.0.0.0
 ENV LANGFLOW_PORT=7860
 ENV LANGFLOW_AUTO_LOGIN=false
+ENV LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
+ENV LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true
+ENV LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true
+ENV LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK=false
+ENV LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES=mcp-proxy,lfx
+ENV LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
+ENV LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true
 
 CMD ["langflow-base", "run"]

docker/build_and_push_ep.Dockerfile

@@ -122,6 +122,13 @@ ENV LANGFLOW_HOST=0.0.0.0
 ENV LANGFLOW_PORT=7860
 ENV LANGFLOW_EVENT_DELIVERY=polling
 ENV LANGFLOW_AUTO_LOGIN=false
+ENV LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
+ENV LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true
+ENV LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true
+ENV LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK=false
+ENV LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES=mcp-proxy,lfx
+ENV LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
+ENV LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true
 
 USER 1000
 CMD ["python", "-m", "langflow", "run", "--host", "0.0.0.0", "--backend-only"]

docker/build_and_push_with_extras.Dockerfile

@@ -123,5 +123,12 @@ WORKDIR /app
 ENV LANGFLOW_HOST=0.0.0.0
 ENV LANGFLOW_PORT=7860
 ENV LANGFLOW_AUTO_LOGIN=false
+ENV LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
+ENV LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true
+ENV LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true
+ENV LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK=false
+ENV LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES=mcp-proxy,lfx
+ENV LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
+ENV LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true
 
 CMD ["langflow", "run"]

docs/docs/Develop/api-keys-and-authentication.mdx

@@ -457,16 +457,60 @@ SSRF protection prevents requests to internal or private network resources, such
 
 | Variable | Format | Default | Description |
 |----------|--------|---------|-------------|
-| `LANGFLOW_SSRF_PROTECTION_ENABLED` | Boolean | `False` | Enable SSRF protection for the **API Request** component. When enabled, the component blocks requests to private IP addresses. When disabled, requests are not blocked. |
+| `LANGFLOW_SSRF_PROTECTION_ENABLED` | Boolean | `True` | Enable SSRF protection for the **API Request** component. When enabled, the component blocks requests to private IP addresses. When disabled, requests are not blocked. |
 | `LANGFLOW_SSRF_ALLOWED_HOSTS` | List[String] | Not set | A comma-separated list of allowed hosts, IP addresses, or CIDR ranges that can bypass SSRF protection checks. For example: `192.168.1.0/24,10.0.0.5,*.internal.company.local`.|
+| `LANGFLOW_CONNECTOR_SSRF_VALIDATION_ENABLED` | Boolean | `True` | Apply SSRF host validation to connector components that take a tenant-controlled host or URL, including vector stores, SQL databases, model-provider discovery, and remote service base URLs. It defers to `LANGFLOW_SSRF_PROTECTION_ENABLED` and `LANGFLOW_SSRF_ALLOWED_HOSTS` for the host policy. Set to `false`, or allowlist specific hosts, only when a trusted single-tenant deployment intentionally connects to private-network services. |
+| `LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK` | Boolean | `True` | Preserve literal `localhost`, `127.0.0.0/8`, and `::1` connector targets for common local deployments. Set to `false` when mutually-untrusted tenants must not reach services bound to loopback. Hostnames that merely resolve to loopback are still validated. |
+
+:::note Multi-tenant recommendation
+In a multi-tenant deployment where mutually-untrusted users build flows, keep `LANGFLOW_CONNECTOR_SSRF_VALIDATION_ENABLED=true` and `LANGFLOW_SSRF_PROTECTION_ENABLED=true`. Allowlist your own internal hosts with `LANGFLOW_SSRF_ALLOWED_HOSTS`.
+:::
+
+### Multi-tenant component hardening {#multi-tenant-component-hardening}
+
+The following environment variables close code-execution and local-file-read surfaces that remain reachable through *built-in* components even when user-authored custom components are disabled.
+They are disabled by default to preserve single-tenant behavior, and are meant to be set together with [`LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false`](/deployment-block-custom-components) in deployments where mutually-untrusted users build flows.
+
+| Variable | Format | Default | Description |
+|----------|--------|---------|-------------|
+| `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | Boolean | `False` | When `true`, blocks execution of flows containing built-in arbitrary-code-execution components, including Python interpreter/REPL tools, lambda evaluators, and code-running agents. |
+| `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | Boolean | `False` | When `true`, built-in file-reading components can read only from the authenticated user's or executing flow's storage namespace, and `save_file` writes are confined there. This also blocks local-file database dialects and local-filesystem Git clones. |
+| `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | When `true`, MCP Docker transports are limited to isolated `docker run` invocations. Host file/API/device access, namespace sharing, named networks, published ports, custom runtimes, restart persistence, and sandbox downgrades are rejected. Published Langflow images enable this by default. |
+| `LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES` | String | Not set | A comma-separated allowlist of exact package names that MCP `npx` and `uvx` stdio servers may download and execute. Version pins are permitted, but direct URL/path references and package-injection options are rejected. Published Langflow images allow only `mcp-proxy` and `lfx` by default. |
+| `LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING` | Boolean | `False` | When `true`, MCP stdio configurations cannot execute tenant-selected Python modules/scripts, Node.js files, or direct shell scripts. Validated package-runner wrappers and Langflow's authenticated internal agentic MCP module remain available. Published Langflow images enable this by default. |
+
+:::caution Upgrade behavior
+This hardening limits `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true` to the authenticated user's or executing flow's storage namespace. Before upgrading a deployment that already enables this setting, move component-managed files stored directly under `config_dir` into the appropriate user or flow storage namespace and update saved paths.
+:::
+
+:::note Multi-tenant recommendation
+For a deployment where mutually-untrusted users build flows, set `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false`, `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true`, `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true`, `LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true`, `LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true`, and `LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES` together. Pair these controls with the SSRF settings above.
+:::
+
+:::warning Tracing in multi-tenant deployments
+External tracing integrations are configured process-wide, not per user. When one is enabled in a multi-tenant deployment, every tenant's flow inputs, outputs, and prompts are sent to that external project. Do not enable a shared SaaS tracing backend where mutually-untrusted tenants can build flows; use built-in local tracing instead.
+:::
+
+### Session cookie hardening {#session-cookie-hardening}
+
+For a multi-tenant deployment served over HTTPS, harden the access-token cookie. These default to permissive values for local/HTTP development and for the current frontend, which reads the access token in JavaScript.
+
+| Variable | Format | Default | Description |
+|----------|--------|---------|-------------|
+| `LANGFLOW_ACCESS_SECURE` | Boolean | `False` | When `true`, the `access_token_lf` cookie is sent only over HTTPS. Recommended `true` for any HTTPS deployment. Leave `false` for plain-HTTP/localhost development, where a `Secure` cookie would not be sent. |
+| `LANGFLOW_ACCESS_HTTPONLY` | Boolean | `False` | When `true`, the `access_token_lf` cookie is not readable by JavaScript (mitigates token theft via XSS). The default is `false` because the bundled frontend currently reads this cookie in JavaScript; enabling `HttpOnly` requires a frontend that does not read the token directly. |
+| `LANGFLOW_ACCESS_SAME_SITE` | String | `lax` | The `SameSite` attribute of the access-token cookie (`lax`, `strict`, or `none`). |
+
+The refresh-token cookie is already `HttpOnly` + `Secure` + `SameSite` by default.
 
 ### Login rate limiting {#login-rate-limiting}
 
-The following environment variables configure IP-based rate limiting on the `/login` endpoint to protect against brute-force attacks.
+The following environment variables configure IP-based rate limiting to protect against brute-force attacks on the `/login` endpoint and abuse of public flow endpoints.
 When the limit is exceeded, Langflow returns HTTP 429 with a `Retry-After: 60` header.
 
 | Variable | Format | Default | Description |
 |----------|--------|---------|-------------|
+| `LANGFLOW_RATE_LIMIT_ENABLED` | Boolean | `True` | Enable rate limiting globally. Set to `False` to disable all rate limiting (not recommended in production). |
 | `LANGFLOW_RATE_LIMIT_PER_MINUTE` | Integer | `5` | Maximum number of login attempts allowed per minute from a single IP address. |
 | `LANGFLOW_RATE_LIMIT_STORAGE_URI` | String | `memory://` | Storage backend for rate limit counters. Use `memory://` for single-server deployments or `redis://host:port` for multi-server deployments where the limit should be shared across instances. |
 | `LANGFLOW_RATE_LIMIT_TRUST_PROXY` | Boolean | `False` | When `true`, Langflow reads the client IP from the rightmost `X-Forwarded-For` header entry instead of the direct connection IP. Enable only when Langflow is behind a trusted reverse proxy or load balancer. Do not enable if users can reach Langflow directly, as this allows header spoofing. |

docs/docs/Develop/environment-variables.mdx

@@ -446,6 +446,7 @@ See [Telemetry](/contributing-telemetry).
 | `LANGFLOW_ALLOW_COMPONENTS_PATHS_OVERRIDE` | Boolean | `True` | When `false` alongside `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false`, components contributed by `LANGFLOW_COMPONENTS_PATH` and `LANGFLOW_COMPONENTS_INDEX_PATH` no longer bypass the block. Has no effect when `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=true`. For more information, see [Block custom components](../Deployment/deployment-block-custom-components.mdx). |
 | `LANGFLOW_LOAD_FLOWS_PATH` | String | Not set | Path to a directory containing flow JSON files to be loaded on startup. Typically used when creating a Docker image with prepackaged flows. Requires `LANGFLOW_AUTO_LOGIN=True`. |
 | `LANGFLOW_LOAD_FLOWS_OVERWRITE_ON_NAME_MATCH` | Boolean | `False` | When a flow file in `LANGFLOW_LOAD_FLOWS_PATH` shares a name with an existing DB row but has a different `id`, controls whether to overwrite the existing row. `False` (default) skips with a warning so UI edits are preserved on restart when file UUIDs regenerate. Set to `True` to opt into prepackaged-flows-are-source-of-truth semantics, typically for CI/CD pipelines. |
+| `LANGFLOW_LOAD_FLOWS_PRESERVE_VARIABLE_BINDINGS` | Boolean | `True` | Preserve global-variable bindings configured in the visual editor when an existing flow is reloaded from `LANGFLOW_LOAD_FLOWS_PATH`. Bindings explicitly configured in the flow file still take precedence. Set to `False` to restore blind replacement of the flow data on restart. |
 | `LANGFLOW_CREATE_STARTER_PROJECTS` | Boolean | `True` | Whether to create templates during initialization. If `false`, Langflow doesn't create templates, and `LANGFLOW_UPDATE_STARTER_PROJECTS` is treated as `false`. |
 | `LANGFLOW_UPDATE_STARTER_PROJECTS` | Boolean | `True` | Whether to update templates with the latest component versions when initializing after an upgrade. |
 | `LANGFLOW_LAZY_LOAD_COMPONENTS` | Boolean | `False` | If `true`, Langflow only partially loads components at startup and fully loads them on demand. This significantly reduces startup time but can cause a slight delay when a component is first used. |
@@ -485,4 +486,4 @@ You can hide individual elements without enabling the umbrella flag.
 | `LANGFLOW_HIDE_NEW_PROJECT_BUTTON` | Boolean | `False` | If `true`, hides the new project/folder button in the sidebar. Automatically enabled when `LANGFLOW_EMBEDDED_MODE=true`. |
 | `LANGFLOW_HIDE_NEW_FLOW_BUTTON` | Boolean | `False` | If `true`, hides the new flow button in the header. Automatically enabled when `LANGFLOW_EMBEDDED_MODE=true`. |
 | `LANGFLOW_HIDE_STARTER_PROJECTS` | Boolean | `False` | If `true`, hides the starter projects tab in the templates modal. Does not affect database seeding of starter projects. Automatically enabled when `LANGFLOW_EMBEDDED_MODE=true`. |
-| `LANGFLOW_HIDE_GETTING_STARTED_PROGRESS` | Boolean | `False` | If `true`, hides the getting-started onboarding progress UI. Not automatically enabled when `LANGFLOW_EMBEDDED_MODE=true`. |
+| `LANGFLOW_HIDE_GETTING_STARTED_PROGRESS` | Boolean | `False` | If `true`, hides the getting-started onboarding progress UI. Not automatically enabled when `LANGFLOW_EMBEDDED_MODE=true`. |

src/backend/base/langflow/agentic/api/deps.py

@@ -0,0 +1,23 @@
+"""Shared dependencies for the agentic API.
+
+Kept in a leaf module (only fastapi + lfx settings) so both the route definitions
+(langflow.agentic.api.router) and the router-include site (langflow.api.router) can import it
+without a circular import.
+"""
+
+from fastapi import HTTPException, status
+from lfx.services.deps import get_settings_service
+
+
+def require_agentic_experience() -> None:
+    """Backend gate for the agentic assistant's code-generating/executing endpoints.
+
+    SECURITY: the assistant generates and EXECUTES component code in-process
+    (langflow.agentic.helpers.validation.validate_component_runtime and the user-components
+    overlay). ``agentic_experience`` was only a frontend/UX + MCP-provisioning flag, so the codegen
+    endpoints were live by default. Gate them here (404 when off), matching the per-endpoint
+    precedent in api/v1/endpoints.py. The read-only ``/agentic/check-config`` probe is intentionally
+    NOT gated so non-agentic deployments can still query provider configuration.
+    """
+    if not get_settings_service().settings.agentic_experience:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="This endpoint is not available")