CVE-2026-105699highBroken access control2026-10-07

CVE-2026-105699: Langflow's project MCP endpoint lets a logged-in user read other users' flow files, fixed in 1.9.1

Langflow 1.6.8 through 1.9.0 checks that you may access the project in a project-scoped MCP connection, but not the file URI you then ask for with resources/read, so any authenticated user can download files stored in other users' flows. Upgrade to 1.9.1 or later.

01.

What it is

The project-scoped MCP transport authenticates the caller only for the project_id in the connection URL.

read_resource() forwards the attacker-supplied URI to handle_read_resource(), which takes the flow_id and filename from the URI and reads the file without checking ownership or project membership.

The result is a cross-user authorization bypass: user A can read files under user B's flow namespaces.

02.

How to check

Run pip show langflow and see whether the version is between 1.6.8 and 1.9.0.
This matters most on shared Langflow servers with more than one user account.

03.

How to fix

Upgrade Langflow to 1.9.1 or later (the current release line is well past this).
Until then, don't give untrusted people accounts on a Langflow server that holds other users' files.

pip show langflow | grep -i ^version
pip install -U 'langflow>=1.9.1'

04.

Sources

More advisories for this tool