CVE-2026-105699: Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Langflow’s project-scoped MCP transport authenticates the caller for the project_id in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply a crafted file-download URI that points to another user’s flow-backed file. The server then reads and returns the victim file without verifying ownership or project membership.
This is a cross-user authorization bypass (userA -> userB) that allows arbitrary read access to files stored under other users’ flow namespaces.
References
- github.com/advisories/GHSA-4hmc-cfm3-w43c
- github.com/langflow-ai/langflow/commit/b8fe970493fd5fb2e1fc71dfccc79f90b76058fa
- github.com/langflow-ai/langflow/commit/f0fd436fe9829192ee550e6cb46961a01dd37032
- github.com/langflow-ai/langflow/pull/12818
- github.com/langflow-ai/langflow/releases/tag/v1.9.1
- github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c
- nvd.nist.gov/vuln/detail/CVE-2026-105699
Code Behaviors & Features
Detect and mitigate CVE-2026-105699 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →