EUVD-2026-92796

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers...

CVE-2026-105699

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-105699

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-105699: Authorization Bypass Through User-Controlled Key

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

PT-2026-106234

Name of the Vulnerable Software and Affected Versions Langflow versions 1.6.8 through 1.9.0 Description Langflow fails to properly authorize the resource URI provided to the resources/read endpoint. The read resource function forwards the attacker-controlled URI to handle read resource, which...