Vulnerability in langflow (CVE-2026-105699)
Summary
Vulnerability in langflow (CVE-2026-105699). Risk of unauthorized operations or information disclosure. Exploitable via GET /api/v1/files/download/.... Mitigation: upgrade to 1.9.1 or later.
Original description
The description as published by the source.
Summary
Langflow's project-scoped MCP transport authenticates the caller for the project_id in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply a crafted file-download URI that points to another user's flow-backed file. The server then reads and returns the victim file without verifying ownership or project membership.
This is a cross-user authorization bypass (userA -> userB) that allows arbitrary read access to files stored under other users' flow namespaces.
Details
Verified against local checkout:
- Repository:
langflow-ai/langflow - Verified on release tag:
v1.8.3 - Commit:
08bf98404cfd7737fde57a2588785766cdf1b42e - Earliest stable release known to contain the vulnerable code path:
v1.6.8
Relevant code path:
-
src/backend/base/langflow/api/v1/mcp_projects.py:147-193
verify_project_auth_conditional()authenticates the caller and checks access only to theproject_idin the MCP transport URL. -
src/backend/base/langflow/api/v1/mcp_projects.py:1238-1241
The project-scoped MCP server registersread_resource()and forwards the attacker-controlled URI directly tohandle_read_resource(uri=uri). -
src/backend/base/langflow/api/v1/mcp_utils.py:163-182
handle_read_resource()parses the last two URI path segments asflow_idandfilename, then directly calls:
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-105699 has been found in langflow.
Attackers can target a specific entry point like GET /api/v1/files/download/... over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade langflow to 1.9.1 or later.
If unsure, ask your IT team or search "langflow CVE-2026-105699" on the vendor's site.
CVE-2026-105699 (langflow) — CWE-639
Attack surface: GET /api/v1/files/download/... / POST /api/v1/mcp/project/ / project_id / flow_id
Patched: 1.9.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-639) exists in langflow. Attackers reach the vulnerable code path via GET /api/v1/files/download/....
Check the vendor advisory for the affected versions of langflow. Attack surface: GET /api/v1/files/download/... / POST /api/v1/mcp/project/ / project_id / flow_id.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 1.9.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual GET /api/v1/files/download/... requests with malformed payloads or SQL meta-characters. Run grep -r 'langflow' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'langflow' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
langflowを grep し、稼働しているサービス・バージョンを把握する。 -
2Hunt for indicators of compromise detect
grep 'GET /api/v1/files/download/...' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'アクセスログで
GET /api/v1/files/download/...への異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。 -
3Apply patch patch
Upgrade langflow to 1.9.1ステージング環境で 1.9.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 2 で見つけた異常検知の続報チェックを含めること。
-
4Post-deployment verification verify
Replay attack against GET /api/v1/files/download/... on staging to confirm patch closes the vectorパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。