CVE-2026-105699

Executive Summary

CVE-2026-105699 is a broken object-level authorization (IDOR) vulnerability in Langflow, an open-source platform for building and deploying AI-powered agents and workflows. From version 1.6.8 until 1.9.1, the project-scoped MCP (Model Context Protocol) connection endpoint authenticated the project identifier but failed to authorize the resource URI passed to resources/read, allowing any authenticated user with access to a project-scoped MCP endpoint to read another user's flow-backed files across tenants. Successful exploitation results in the disclosure of uploaded documents, structured data, prompts, and other private flow artifacts, though it does not permit modification of victim files or stored flows.

Technical Analysis

The vulnerability resides in the authorization logic governing Langflow's MCP (Model Context Protocol) server integration. Langflow 1.6.8 through 1.9.0 authenticated access to the project identifier in a project-scoped MCP connection, but did not authorize the resource URI supplied to the resources/read operation. The read_resource handler forwarded the attacker-controlled URI directly to handle_read_resource, which parsed a flow_id and filename from the request and subsequently called storage_service.get_file. Critically, storage_service.get_file performed no verification that the referenced flow belonged to the authenticated user or to the current project.

This constitutes a classic broken object-level authorization flaw (CWE-639): the application enforces authentication ("is the caller logged in and permitted to reach the project-scoped MCP endpoint?") but omits object-level authorization ("does this specific flow_id belong to the caller's project?"). The trusted boundary of the project identifier is effectively bypassed because the attacker supplies an arbitrary flow_id within the resource URI, and the server dereferences it without an ownership check.

Two supporting weaknesses compound the issue. First, the global handle_list_resources and handle_list_tools behaviors could disclose flow and file identifiers, meaning an attacker does not necessarily need to guess or brute-force identifiers. These enumeration primitives make reliable targeting of other users' flows easier. Second, because MCP is designed as a machine-to-machine protocol consumed by LLM agents and workflow tooling, the resources exposed include not just raw documents but prompts and other sensitive flow artifacts — precisely the highest-value data in an AI orchestration platform.

The attack is network-reachable (AV:N), requires low privileges (PR:L — any authenticated user with access to a project-scoped MCP endpoint), requires no user interaction (UI:N), and produces a high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). No public proof-of-concept, Nuclei template, or exploit code exists at the time of writing, and the vulnerability has not been scored by FIRST.org's EPSS.

Exploitation Scenarios

1) Reconnaissance / Target Identification: An attacker obtains authenticated access to a Langflow instance at version 1.6.8 through 1.9.0, with access to at least one project-scoped MCP endpoint. In a multi-tenant deployment, the attacker enumerates flow and file identifiers by invoking the MCP resource-listing capabilities (handle_list_resources and handle_list_tools), which per the advisory could disclose flow and file identifiers belonging to other users. Alternatively, if flow identifiers are predictable or leak through other interfaces, the attacker can compile a target list directly. No public PoC is available; this stage is inferred from the documented disclosure behavior.

2) Triggering the Flaw: The attacker issues a resources/read request to the project-scoped MCP connection, supplying an attacker-controlled resource URI that references a flow_id and filename not belonging to their project. The project-scoped MCP endpoint validates the project identifier for the connection but does not validate the URI's target object. This is the core IDOR/CWE-639 trigger — a legitimate, authorized request shape carrying an unauthorized object reference.

3) Execution Path: The read_resource function forwards the attacker-controlled URI to handle_read_resource. That handler parses the flow_id and filename from the URI and calls storage_service.get_file. Because storage_service.get_file performs no ownership or project-membership verification, it returns the file backing the referenced flow, regardless of the tenant that owns it. The attacker receives the contents in the MCP response.

4) Post-Exploitation Impact: The attacker exfiltrates uploaded documents, structured data, prompts, and other private flow artifacts across tenants. Per the advisory, the vulnerability disclosed files but did not modify victim files or stored flows, so this is a confidentiality-only compromise. The extracted data materially aids follow-on attacks: prompts and structured data can reveal system instructions, internal business logic, credentials embedded in workflow configuration, or sensitive document contents belonging to other tenants.

Impact Assessment

The impact is a cross-tenant confidentiality breach affecting all Langflow deployments running versions 1.6.8 through 1.9.0 that expose project-scoped MCP endpoints to more than one user or tenant. Blast radius scales with the number of flows and files stored in the instance: any flow-backed file is potentially reachable by any authenticated user with access to a single project-scoped MCP endpoint. Because MCP is intended for direct agent/tool consumption, exposed resources may include not only uploaded documents but also prompts and other artifacts that commonly contain sensitive operational detail.

Mapping to CVSS v3.1 subscores: AV:N (remote network reachability via the MCP endpoint), AC:L (no special conditions beyond a valid URI), PR:L (requires an authenticated low-privilege account with MCP project access), UI:N (no victim action needed), S:U (impact remains within Langflow's security scope), C:H (full read access to other tenants' flow artifacts), I:N (no modification), A:N (no availability impact). The overall qualitative severity is High based on the confidentiality-only, cross-tenant, low-complexity nature of the flaw. No EPSS score is available, and there is no evidence of exploitation in the wild, inclusion in CISA KEV, or public exploit tooling.

Detection Guidance

Sigma Rule

title: Langflow MCP resources/read Cross-Tenant File Access (CVE-2026-105699)
id: 3f8b2c14-9a7d-4e21-b6c8-langflow105699
status: experimental
description: Detects MCP resources/read requests referencing flow_id values, indicative of unauthorized cross-tenant file access in Langflow 1.6.8-1.9.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105699
author: valtersit.com
date: 2026/01/01
logsource:
  product: langflow
  service: mcp
detection:
  selection_method:
    method: 'resources/read'
  selection_uri:
    uri|contains: 'flow_id'
  condition: selection_method and selection_uri
fields:
  - user
  - project_id
  - uri
  - flow_id
falsepositives:
  - Legitimate users reading resources within their own project
level: medium

YARA Rule

rule CVE_2026_105699_Langflow_MCP_IDOR
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-105699 cross-tenant file read in Langflow MCP resources/read"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105699"
        date = "2026-01-01"

    strings:
        $mcp_method = "resources/read"
        $flow_id    = "flow_id"
        $filename   = "filename"
        $handle     = "handle_read_resource"

    condition:
        $mcp_method and $flow_id and $filename
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105699 Langflow MCP resources/read Cross-Tenant File Access Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"resources/read"; content:"flow_id"; content:"filename"; classtype:attempted-recon; reference:cve,2026-105699; sid:2026105699; rev:1;)

Elastic Detection

sequence by user.name
  [ network where network.protocol == "http" and http.request.method == "POST"
      and http.request.body contains "resources/read" ]
  [ network where http.request.body contains "flow_id"
      and http.request.body contains "filename" ]

Splunk SPL Query

index=langflow sourcetype=langflow:mcp
| search method="resources/read" uri="*flow_id*"
| stats count values(uri) as uris by user, project_id, src_ip
| where count > 5

Wazuh OSSEC Rule

<group name="langflow,mcp,">
  <rule id="105699" level="10">
    <decoded_as>json</decoded_as>
    <field name="method">resources/read</field>
    <field name="uri" type="pcre2">flow_id</field>
    <description>CVE-2026-105699: Langflow MCP resources/read cross-tenant file access attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source in the data provided). Note that the NVD description states the issue is fixed in version 1.9.1; this should be verified directly against the upstream project before relying on it.

1. Immediate mitigations: Restrict network access to project-scoped MCP endpoints to trusted users and services only (network segmentation, reverse-proxy allowlists, or mTLS). If MCP is not operationally required, disable project-scoped MCP connections entirely. Reduce tenant sprawl by isolating Langflow instances per trust boundary so that a single authenticated user cannot share an instance with flows belonging to other tenants. Monitor MCP resources/read activity for flow_id/filename parameters that reference objects outside the caller's project.

2. Patch/upgrade steps: Upgrade Langflow to version 1.9.1 or later, which the advisory identifies as the fixed release. Verify the fix by confirming that storage_service.get_file (or its replacement) enforces ownership/project-membership checks and that the resources/read handler authorizes the resource URI before dereferencing it. Where a vendor advisory is available, follow it; otherwise track the upstream project's security release notes directly.

3. Long-term hardening: Enforce object-level authorization as a mandatory control on every MCP resource operation, not just at the connection/project level (implement ownership checks server-side for each flow_id). Adopt least-privilege project membership and avoid multi-tenant sharing of single Langflow instances. Add automated regression tests for cross-tenant resource access, and integrate authorization fuzzing to catch CWE-639 patterns in MCP and REST interfaces. Log and alert on identifier enumeration via handle_list_resources and handle_list_tools.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-105699 — NVD entry (describes the vulnerability and affected range 1.6.8–1.9.1)
• Langflow upstream project security advisories/release notes for version 1.9.1 (candidate fix reference; confirm directly with the vendor)
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• CISA Known Exploited Vulnerabilities catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-105699 is not currently listed)
• FIRST.org EPSS — https://www.first.org/epss/ (CVE-2026-105699 not yet scored at time of writing)

No public proof-of-concept, Nuclei template, or exploit code is known to exist for CVE-2026-105699. There is no evidence of active exploitation in the wild or association with any known threat actor campaign.