Authenticated Cross-Project File Disclosure in Langflow MCP

Vulnerability Overview Title: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers Description: The project-level MCP transport in Langflow validates the caller's in the connection URL, but subsequent operations do not authorize the requested resource URI. An authenticated user can connect to their own project-level MCP endpoint and provide a crafted file-download URI pointing to another user's flow backup file. The server reads and returns the victim's file without verifying ownership or project membership. Details: Verified in local checkout. Repository: langflow-ai/langflow Verified on release tag v1.8.3. Commit: 084498484cf67737f6937a2988785766cf21d42e Earliest stable version known to contain the vulnerable code path: v1.6.8 Relevant Code Paths: 1. 2. 3. 4. 5. PoC: Impact CVSS v4: 4.0/W:/A:C/L:T/PR:N/LU:T/CR:H/I:H/A:H/SC:N/SI:H/SA:H Estimated Score: 7.1 (High) Actual Impact: Disclosure of uploaded documents, CSV files, JSON files, prompts, and other flow backup artifacts across users. Unauthorized access to sensitive business data stored in namespaces. Easier exploitation when the global MCP assistant reveals other users' flow IDs and file names. Remediation 1. Authorize to verify authentication context before accessing storage: - Resolve to a database object and validate: - - For project-level transports, 2. Stop trusting arbitrary file download URIs as resource identifiers: - Instead, return opaque server-generated resource IDs from and resolve them server-side to authorized objects. 3. Restrict global MCP enumeration assistants to authenticated users: - and should not query all flows when ; they should only return flows owned by the current user, or require higher privileges for broader discovery. Remediation Status: This report is accurate. The missing ownership check in described in the vulnerability code path has been fixed. Confirmed affected version range: >= 1.6.8, < 1.9.0 (not <= 1.8.3) Confirmed vulnerability still exists in v1.9.0; fixed in v1.9.1. Fix in: v1.9.1 (GitHub Release published 2026-04-24), via PR #12818 Backport commit in: release-1.9.1: f8f6436fe9231933ae558ecb49f61a15d877832 Corresponding commit in main: b8f96794893fd2e2e1fc715fcc79f89676058fa Fix Details: now requires authentication user context and resolves the namespace segment of the URI to a Flow object to validate , additionally filtering by for project-level MCP servers. Filenames containing or are rejected as a defense-in-depth measure, and the same containment checks are applied to the storage layer's , , , and . and are now restricted to the current user ID on global (non-project-level) MCP servers, closing the cross-user enumeration vector identified in this report. Independent Verification: Independent verification against langflow-ai/langflow @ 894442865 (release-1.1.0 branch, current as of 2026-09-22) confirms the fix is present. The regression suite ( , 21/21 passing) includes , which reproduces this report's exact cross-user scenario and asserts that it now raises . Severity: High_CVSS v4 7.1 and CWE-639 classification reviewed and confirmed applicable to the pre-fix behavior.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated Cross-Project File Disclosure in Langflow MCP

More from this source