Executive brief
IBM Langflow OSS is an open-source platform for building and managing AI workflows. Due to improper cache key isolation in the MCP Tools component, an authenticated attacker can access another user's MCP server context, potentially exposing sensitive flow configurations and data. This could lead to unauthorized access to workflows and information leakage across user boundaries.
Technical details
The vulnerability is a missing authentication / improper cache isolation issue (CWE-306) in the MCP Tools component of Langflow OSS. The root cause is insufficient cache key isolation that fails to properly segregate MCP server contexts between different authenticated users. An authenticated attacker can craft requests to access cached MCP contexts belonging to other users, bypassing intended access controls. The vulnerability requires authentication and network access to the Langflow API; no user interaction is required. An attacker can enumerate and access another user's MCP server context. IBM recommends upgrading to version 1.11.6 or later, which addresses this cache isolation flaw.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.5
Timeline
- 2026-09-08: disclosed
- 2026-09-14: patched: Fix available in version 1.11.6