CVE-2026-12763: Langflow: MCP cache isolation flaw leaks user context

MEDIUM

Published September 14, 2026

CISO Take

Langflow OSS versions 1.0.0 through 1.11.5 fail to isolate cache keys in the MCP Tools component, so an authenticated user can access another user's MCP server context (CVE-2026-12763, CWE-306). The practical risk is moderate: CVSS is 4.2 with high attack complexity, there is no public exploit, no Nuclei template, no CISA KEV listing and a SSVC decision of TRACK. The EPSS score is very low (0.00148), although the percentile label in our feed reads as top 97%, so treat the exploitation-likelihood signal as inconsistent and rely on the absolute probability. The real concern is multi-tenant Langflow deployments, where MCP contexts can carry connection details, tool definitions or credentials for downstream systems. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7286662), and until then avoid sharing a Langflow instance between teams with different trust levels.

Sources:NVDEPSSATLASibm.com

What is the risk?

Medium-Low overall. Exploitation requires a valid low-privilege account, network access and conditions that raise attack complexity (CVSS AC:H). There is no known public exploit, no scanner template and no KEV listing, and EPSS is 0.00148. Impact is limited to low confidentiality and integrity loss (C:L/I:L, no availability impact). Risk rises in shared or multi-tenant Langflow instances where MCP servers hold sensitive tool access or credentials. Single-user or isolated deployments face little exposure. Confidence: MEDIUM, because the advisory text is brief and the affected component details are not fully documented.

How does the attack unfold?

Initial Access

Attacker signs in to a shared Langflow instance with a valid low-privilege account.

AML.T0012

Exploitation

Attacker uses the MCP Tools component so the shared cache key resolves to another user's MCP server context.

AML.T0049

Tool Access

Attacker enumerates and invokes tools exposed by the victim's MCP context from their own flow.

AML.T0053

Impact

Attacker reads data or performs limited actions through the victim's MCP-connected systems, causing low confidentiality and integrity loss.

AML.T0085.001

Initial Access

Attacker signs in to a shared Langflow instance with a valid low-privilege account.

AML.T0012

Exploitation

Attacker uses the MCP Tools component so the shared cache key resolves to another user's MCP server context.

AML.T0049

Tool Access

Attacker enumerates and invokes tools exposed by the victim's MCP context from their own flow.

AML.T0053

Impact

Attacker reads data or performs limited actions through the victim's MCP-connected systems, causing low confidentiality and integrity loss.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 4d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

4.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7286662); versions after 1.11.5 should be validated against that advisory. 2) Until patched, avoid multi-user sharing of instances that use the MCP Tools component, or run separate instances per trust boundary. 3) Review and rotate credentials and tokens configured in MCP servers used through Langflow if multiple users share the instance. 4) Restrict Langflow account creation and access to trusted users and place the service behind SSO or a VPN. 5) Detection: review Langflow and MCP server logs for tool calls or sessions where the acting user does not match the user who configured the MCP server, and for unusual MCP calls from low-privilege accounts. 6) Apply least privilege to the downstream systems MCP servers can reach.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkAgentPluginAML.T0012- Valid Accounts AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown or emergent risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-12763?

Is CVE-2026-12763 actively exploited?

No confirmed active exploitation of CVE-2026-12763 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12763?

1) Upgrade Langflow OSS to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7286662); versions after 1.11.5 should be validated against that advisory. 2) Until patched, avoid multi-user sharing of instances that use the MCP Tools component, or run separate instances per trust boundary. 3) Review and rotate credentials and tokens configured in MCP servers used through Langflow if multiple users share the instance. 4) Restrict Langflow account creation and access to trusted users and place the service behind SSO or a VPN. 5) Detection: review Langflow and MCP server logs for tool calls or sessions where the acting user does not match the user who configured the MCP server, and for unusual MCP calls from low-privilege accounts. 6) Apply least privilege to the downstream systems MCP servers can reach.

What systems are affected by CVE-2026-12763?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP tool integrations, Multi-tenant LLM workflow platforms, Low-code LLM orchestration.

What is the CVSS score for CVE-2026-12763?

CVE-2026-12763 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMCP tool integrationsMulti-tenant LLM workflow platformsLow-code LLM orchestration

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

Exploitation Scenario

An attacker with a low-privilege account on a shared Langflow instance builds a flow using the MCP Tools component and points it at an MCP server configuration that collides with a cache key used by another user. Because the cache key does not include user identity, the component returns the other user's cached MCP server context. The attacker then lists the tools available in that context and invokes them from their own flow, reading data such as internal documents or tickets, or triggering actions the victim user was authorized to perform. The high attack complexity reflects the need to match or trigger the right cache state.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-306Missing Authentication for Critical Functionality

CWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.