Langflow EUVD-2026-92796

Requires a valid authenticated account with access to any project-scoped MCP connection/endpoint in Langflow versions 1.6.8 through 1.9.0 (PR:L). The deployment must expose the project-scoped MCP server feature (the resources/read handler), and meaningful impact requires a multi-tenant or multi-user instance where other users' flow-backed files exist to be read cross-tenant. Limiting factors: exploitation is read-only (no file or flow modification), the attacker needs a legitimate login, and knowing or enumerating a victim's flow_id plus filename is required (eased by the over-broad list_resources/list_tools disclosure that the same patch also scopes to the caller). Single-tenant self-hosted installs face little practical exposure.

This is a cross-tenant information-disclosure flaw (CWE-639, insecure direct object reference) confirmed by the vendor GitHub Security Advisory GHSA-4hmc-cfm3-w43c and the source-code patch. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the provided score of 7.1 agree with the description: exploitation is network-reachable, low-complexity, requires no user interaction, but DOES require authentication (PR:L) - any user holding access to a project-scoped MCP endpoint. Impact is confidentiality-only (VC:H, VI:N, VA:N); the description explicitly states victim files and stored flows are not modified, which is consistent. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC in the provided intelligence (the GitHub commit/PR links are the fix, not weaponized exploit code). No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. Net assessment: a genuine, patch-worthy authorization bug that matters most for multi-tenant / shared Langflow deployments where attacker and victim flows coexist; in a single-user self-hosted install the cross-tenant impact is largely moot. It is not a drop-everything internet-wide emergency (authentication gate, read-only impact, no active-exploitation signal), but should be prioritized for any shared/SaaS Langflow instance. Note: the input Tag 'Authentication Bypass' is imprecise - the vendor CWE-639 and description describe an AUTHORIZATION bypass (authentication succeeded; resource authorization was missing).

An authenticated tenant on a shared Langflow instance connects to a project-scoped MCP endpoint, uses the list_resources/list_tools responses to discover another tenant's flow_id and filename, then issues a resources/read call with a crafted resource URI pointing at that foreign flow-backed file. handle_read_resource forwards the attacker-controlled URI to storage_service.get_file without verifying flow ownership, returning the victim's uploaded documents, prompts, and structured data. No public POC exploit code is identified at time of analysis.