CVE-2026-105699

Name of the Vulnerable Software and Affected Versions Langflow versions 1.6.8 through 1.9.0

Description Langflow fails to properly authorize the resource URI provided to the resources/read endpoint. The read resource function forwards the attacker-controlled URI to handle read resource, which parses a flow id and filename to call storage service.get file() without verifying if the flow belongs to the authenticated user or the current project. Consequently, a user with access to any project-scoped MCP endpoint can request files from another user's flow. Additionally, the handle list resources and handle list tools functions may disclose flow and file identifiers, facilitating targeted attacks. This issue allows the disclosure of uploaded documents, structured data, prompts, and other private flow artifacts across tenants, although it does not allow the modification of files or flows.

Recommendations Update to version 1.9.1.