CVE-2026-105699: Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the attacker-controlled URI to handlereadresource, which parsed a flowid and filename and called storageservice.getfile without verifying that the flow belonged to the authenticated user or current project. A user with access to any project-scoped MCP endpoint could therefore request another user's flow-backed file, while global handlelistresources and handlelisttools behavior could disclose flow and file identifiers that made targeting easier. The vulnerability disclosed uploaded documents, structured data, prompts, and other private flow artifacts across tenants but did not modify victim files or stored flows. This issue is fixed in version 1.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflowto a version that resolves this vulnerability.Fixed in 1.9.1
Event History
Frequently Asked Questions
Which deployments are affected?
Langflow versions from 1.6.8 up to, but not including, 1.9.1 are affected. The issue applies where an authenticated user can access a project-scoped MCP endpoint.
What access does an attacker need?
An attacker needs authenticated access to any project-scoped MCP endpoint. They can then supply a resource URI targeting another user's flow-backed file; no victim interaction is required.
What information could be exposed?
The issue can expose uploaded documents, structured data, prompts, and other private artifacts stored for flows in other projects or tenants. It does not allow modification of victim files or stored flows.
How could an attacker identify files to target?
Global resource and tool listing behavior could disclose flow and file identifiers, making it easier to construct requests for another user's flow-backed files.
What is the remediation?
Upgrade Langflow to version 1.9.1, which fixes the missing authorization check for resource URIs.