AIKIDO-2026-174148
langflow is vulnerable to Authentication Bypass
86
High Risk
This Affects:
langflowTL;DR
Langflow exposes an MCP transport endpoint at /api/v1/mcp/project/{project_id}/streamable for projects that use MCP Composer with OAuth authentication. The project authentication routine skips standard JWT and API-key checks for these projects and falls through to a privileged account, and the streamable handler does not verify that the caller owns the target project. Unauthenticated callers can initialize a session, enumerate a victim's resources, and read arbitrary stored file contents across user and project boundaries. The fix requires a valid credential on the transport endpoint and enforces project ownership before serving resources.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose MCP projects configured with MCP Composer and OAuth authentication.
Background info
langflow is vulnerable to Authentication Bypass in versions 1.8.0 - 1.10.3.
How to fix this
Upgrade the langflow library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.