CVE-2026-105699: CWE-639: Authorization Bypass Through User-Controlled Key in langflow-ai langflow

Langflow versions from 1.6.8 up to and including 1.9.0 contain an authorization bypass vulnerability (CWE-639) where the project-scoped MCP connection authenticated the project identifier but failed to authorize the resource URI supplied to resources/read. The read_resource function forwarded an attacker-controlled URI to handle_read_resource, which parsed flow_id and filename and called storage_service.get_file without verifying ownership or project association. This allowed users with access to any project-scoped MCP endpoint to retrieve private flow-backed files belonging to other users. Additionally, global handlers could disclose flow and file identifiers, facilitating targeted attacks. The vulnerability exposes private data but does not permit modification of victim files or flows. The issue is resolved in version 1.9.1.

An attacker with access to any project-scoped MCP endpoint can read private flow-backed files of other users, including uploaded documents, structured data, and prompts. This leads to unauthorized disclosure of sensitive information across tenants. There is no impact on data integrity as victim files and stored flows cannot be modified through this vulnerability.

Upgrade langflow to version 1.9.1 or later, where this authorization bypass vulnerability is fixed. No other mitigation actions are indicated by the vendor advisory.