CVE-2026-105699: Langflow cross-tenant file read

Q: Is CVE-2026-105699 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-105699, increasing the risk of exploitation.

Q: How to fix CVE-2026-105699?

1) Upgrade langflow to 1.9.1 or later (fix in PR #12818, commits b8fe970 and f0fd436). 2) Until patched, restrict network access to the MCP endpoints, disable project-scoped MCP connections for untrusted users, and avoid hosting multiple tenants on one instance. 3) Review access logs for resources/read calls whose flow_id does not belong to the requesting user or project, and for bulk calls to list_resources and list_tools. 4) Treat uploaded files and prompts stored in affected versions as potentially exposed: rotate any secrets or API keys embedded in prompts or documents and assess data-breach notification obligations. 5) Apply least privilege to Langflow accounts and review who holds MCP access.

Q: What systems are affected by CVE-2026-105699?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, MCP servers/clients, Multi-tenant LLM workflow platforms.

Q: What is the CVSS score for CVE-2026-105699?

No CVSS score has been assigned yet.

CISO Take

Langflow versions 1.6.8 through 1.9.0 let any authenticated user with access to a project-scoped MCP endpoint read other tenants' flow-backed files, because the resource URI passed to resources/read is never checked against the caller's project or ownership. Uploaded documents, structured data, prompts and other private flow artifacts can be disclosed, and the global list_resources and list_tools handlers also leak the flow and file identifiers that make targeting trivial. Exploitation likelihood is currently low to moderate (EPSS 0.00246, top 85th percentile), and there is no public exploit, Nuclei template or CISA KEV listing. However, Langflow has a heavy vulnerability history (191 other CVEs in the package), and a package risk score of 77/100. Upgrade to Langflow 1.9.1 now, and until then restrict MCP endpoint access and review MCP resources/read logs for flow IDs outside the caller's own project.

Sources:NVDGitHub AdvisoryEPSSATLASlangflow-ai/langflow GitHub security advisory

What is the risk?

Risk is HIGH for multi-tenant or shared Langflow deployments and MEDIUM for single-user installs. The flaw is an IDOR (CWE-639) that needs only low-privilege authenticated access and is network-reachable, with no user interaction. Confidentiality impact is high; integrity and availability are unaffected, since the advisory states victim files and stored flows are not modified. Exploitation probability is low today (EPSS 0.00246, no public PoC, not in KEV), but the trivial exploit mechanics and the enumeration help from list_resources and list_tools mean weaponization would be easy. Note: no CVSS vector was published, so severity is taken from the vendor rating.

How does the attack unfold?

Initial Access

Attacker authenticates with any low-privilege account that has access to a project-scoped MCP endpoint.

AML.T0012

Discovery

Attacker calls global list_resources and list_tools to enumerate flow IDs and filenames belonging to other users.

AML.T0007

Exploitation

Attacker sends resources/read with a crafted URI; the server fetches the file via storage_service.get_file without ownership checks.

AML.T0036

Impact

Victim documents, datasets and prompts are exfiltrated across tenants, exposing proprietary data and possible embedded secrets.

AML.T0025

Initial Access

Attacker authenticates with any low-privilege account that has access to a project-scoped MCP endpoint.

AML.T0012

Discovery

Attacker calls global list_resources and list_tools to enumerate flow IDs and filenames belonging to other users.

AML.T0007

Exploitation

Attacker sends resources/read with a crafted URI; the server fetches the file via storage_service.get_file without ownership checks.

AML.T0036

Impact

Victim documents, datasets and prompts are exfiltrated across tenants, exposing proprietary data and possible embedded secrets.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	>= 1.6.8, <= 1.9.0	`1.9.1`
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade langflow to 1.9.1 or later (fix in PR #12818, commits b8fe970 and f0fd436). 2) Until patched, restrict network access to the MCP endpoints, disable project-scoped MCP connections for untrusted users, and avoid hosting multiple tenants on one instance. 3) Review access logs for resources/read calls whose flow_id does not belong to the requesting user or project, and for bulk calls to list_resources and list_tools. 4) Treat uploaded files and prompts stored in affected versions as potentially exposed: rotate any secrets or API keys embedded in prompts or documents and assess data-breach notification obligations. 5) Apply least privilege to Langflow accounts and review who holds MCP access.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassData ExtractionFrameworkAgentRAGAML.T0007- Discover AI Artifacts AML.T0025- Exfiltration via Cyber Means AML.T0036- Data from Information Repositories AML.T0084.001- Tool Definitions

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

8.1-Operational planning and control

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-105699?

Langflow versions 1.6.8 through 1.9.0 let any authenticated user with access to a project-scoped MCP endpoint read other tenants' flow-backed files, because the resource URI passed to resources/read is never checked against the caller's project or ownership. Uploaded documents, structured data, prompts and other private flow artifacts can be disclosed, and the global list_resources and list_tools handlers also leak the flow and file identifiers that make targeting trivial. Exploitation likelihood is currently low to moderate (EPSS 0.00246, top 85th percentile), and there is no public exploit, Nuclei template or CISA KEV listing. However, Langflow has a heavy vulnerability history (191 other CVEs in the package), and a package risk score of 77/100. Upgrade to Langflow 1.9.1 now, and until then restrict MCP endpoint access and review MCP resources/read logs for flow IDs outside the caller's own project.

Is CVE-2026-105699 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-105699, increasing the risk of exploitation.

How to fix CVE-2026-105699?

1) Upgrade langflow to 1.9.1 or later (fix in PR #12818, commits b8fe970 and f0fd436). 2) Until patched, restrict network access to the MCP endpoints, disable project-scoped MCP connections for untrusted users, and avoid hosting multiple tenants on one instance. 3) Review access logs for resources/read calls whose flow_id does not belong to the requesting user or project, and for bulk calls to list_resources and list_tools. 4) Treat uploaded files and prompts stored in affected versions as potentially exposed: rotate any secrets or API keys embedded in prompts or documents and assess data-breach notification obligations. 5) Apply least privilege to Langflow accounts and review who holds MCP access.

What systems are affected by CVE-2026-105699?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, MCP servers/clients, Multi-tenant LLM workflow platforms.

What is the CVSS score for CVE-2026-105699?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesMCP servers/clientsMulti-tenant LLM workflow platforms

MITRE ATLAS Techniques

AML.T0007Discover AI Artifacts

AML.T0025Exfiltration via Cyber Means

AML.T0036Data from Information Repositories

AML.T0084.001Tool Definitions

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: 8.1

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled URI to handle_read_resource, which parsed a flow_id and filename and called storage_service.get_file without verifying that the flow belonged to the authenticated user or current project. A user with access to any project-scoped MCP endpoint could therefore request another user's flow-backed file, while global handle_list_resources and handle_list_tools behavior could disclose flow and file identifiers that made targeting easier. The vulnerability disclosed uploaded documents, structured data, prompts, and other private flow artifacts across tenants but did not modify victim files or stored flows. This issue is fixed in version 1.9.1.

Exploitation Scenario

An attacker with a low-privilege account on a shared Langflow instance, for example a contractor or a free-tier tenant, connects to a project-scoped MCP endpoint they legitimately own. They call the global list_resources and list_tools handlers to enumerate flow and file identifiers belonging to other users, then issue resources/read requests with crafted URIs pointing at those flow_id and filename pairs. The server forwards the URI to storage_service.get_file without ownership checks and returns the victim's uploaded contracts, datasets and system prompts. The attacker exfiltrates the data silently, since nothing is modified, and may reuse leaked prompts or embedded credentials in follow-on attacks.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.