AIKIDO-2026-448894
langflow is vulnerable to Authentication Bypass
86
High Risk
This Affects:
langflowTL;DR
When MCP Composer is enabled and a project uses OAuth authentication, the project MCP endpoint always routes through verify_project_auth, which treats any non-apikey auth type as eligible for a SUPERUSER fallback. Unauthenticated requests to the streamable MCP transport therefore establish a valid superuser context, and the handler never confirms that the requested project or file belongs to the caller. This lets external callers list and read files and MCP resources owned by other users and administrators across projects. The fix (1.10.0) removes OAuth projects from the SUPERUSER-fallback branch and requires a valid API key at the transport endpoint instead of resolving the superuser account.
Who does this affect?
You are affected if you are running a version in the vulnerable range with MCP Composer enabled and a project configured for OAuth authentication, which lets externally reachable, unauthenticated requests to the streamable MCP transport read files and resources belonging to other users.
Background info
langflow is vulnerable to Authentication Bypass in versions 1.6.0 - 1.9.6.
How to fix this
Upgrade the langflow library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant