IBM Langflow OSS CVE-2026-12763

Exploitation requires a valid Langflow user account (CVSS PR:L confirms authentication is necessary). The attacker and victim must be co-tenants on the same IBM Langflow OSS instance running versions 1.0.0-1.11.5. The MCP Tools component must be in active use and caching must be enabled. Attack complexity is rated High (AC:H), meaning the attacker must engineer specific request-sequencing or timing conditions to achieve a cache-key collision with another user's session. Exploitation is limited to reading or influencing the MCP server context of another user - it does not grant broader system access, code execution, or administrative privilege. Single-user deployments, deployments where all users share identical MCP access rights, and deployments with MCP caching disabled are not meaningfully at risk.

The vendor-assigned CVSS 3.1 score of 4.2 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N is credible and reasonably calibrated for this issue. The high attack complexity (AC:H) reflects the need to engineer a cache-key collision under specific timing or request-sequencing conditions. The requirement for prior authentication (PR:L) substantially limits the attack surface to insider threats or compromised accounts on multi-tenant Langflow deployments. Impact is bounded to limited confidentiality (reading another user's MCP context) and limited integrity (potentially influencing their tool execution context), with no availability impact. No KEV listing, no known public exploit, and no EPSS data are provided, all consistent with the moderate CVSS score. Real-world risk is primarily relevant to organizations running shared or multi-user Langflow instances where users have different privilege levels or access rights to MCP servers - single-user or air-gapped deployments are not meaningfully exposed.

An authenticated attacker on a shared Langflow instance sends requests to the MCP Tools component timed or structured to collide with another user's active cache entry, retrieving that user's MCP server context - which may include tool configurations, session tokens, or sensitive workflow parameters. Because the cache key is not user-scoped, the attacker may also cause their own MCP context to be served to the victim on subsequent requests, subtly influencing the victim's AI workflow. No public exploit code is known at time of analysis.