CVE-2026-105699 · GHSA-4hmc-cfm3-w43c
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
- Risk score
- 51/100
- CVSS
- 7.1 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled URI to han…
- Affected
- langflow (pip) >= 1.6.8, <= 1.9.0
- Fix
- Upgrade langflow to 1.9.1 or later.
- Exploitation
- No known exploitation
Story map
At a glance
langflow: Red, act today. Langflow's built-in Python interpreter components — PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow …
The flaws
- CVE-2026-105699: Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers (CVSS 7.1 · EPSS 0%)
- CVE-2026-10561: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation (CVSS 9.9 · EPSS 1%)
- CVE-2026-51886: Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description (CVSS 9.8 · EPSS 0%)
- CVE-2026-105697: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration (CVSS 9.9 · EPSS 0%)
The fix
Upgrade langflow: 1.9.1 · 1.10.1 · 1.10.3 or later on your release line
Who is exposed: langflow (pip) < 1.10.1
Where it stands
- No known exploitation
Connects to
- Same weakness: Authorisation bypass (CWE-639). 244 other warnings in 30 days
Why it is Yellow
- CVSS 7.1 high
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| langflow | pip | >= 1.6.8, <= 1.9.0 | 1.9.1 |
References
- https://github.com/advisories/GHSA-4hmc-cfm3-w43c
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c
- https://nvd.nist.gov/vuln/detail/CVE-2026-105699
- https://github.com/langflow-ai/langflow/pull/12818
- https://github.com/langflow-ai/langflow/commit/b8fe970493fd5fb2e1fc71dfccc79f90b76058fa
- https://github.com/langflow-ai/langflow/commit/f0fd436fe9829192ee550e6cb46961a01dd37032
- https://github.com/langflow-ai/langflow/releases/tag/v1.9.1
- https://github.com/advisories/GHSA-4hmc-cfm3-w43c
Original description
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled URI to handle_read_resource, which parsed a flow_id and filename and called storage_service.get_file without verifying that the flow belonged to the authenticated user or current project. A user with access to any project-scoped MCP endpoint could therefore request another user's flow-backed file, while global handle_list_resources and handle_list_tools behavior could disclose flow and file identifiers that made targeting easier. The vulnerability disclosed uploaded documents, structured data, prompts, and other private flow artifacts across tenants but did not modify victim files or stored flows. This issue is fixed in version 1.9.1.
Last activity 5 Oct 2026. Patch Forecast updates every hour.