AIKIDO-2026-448894

langflow is vulnerable to Authentication Bypass

CVE-2026-8446Published Aug 3, 2026

CVE Score

High

Authentication Bypass

TL;DR

When MCP Composer is enabled and a project uses OAuth authentication, the project MCP endpoint always routes through verify_project_auth, which treats any non-apikey auth type as eligible for a SUPERUSER fallback. Unauthenticated requests to the streamable MCP transport therefore establish a valid superuser context, and the handler never confirms that the requested project or file belongs to the caller. This lets external callers list and read files and MCP resources owned by other users and administrators across projects. The fix (1.10.0) removes OAuth projects from the SUPERUSER-fallback branch and requires a valid API key at the transport endpoint instead of resolving the superuser account.

How do I fix this?

Upgrade the langflow library to the patch version.

Who does this affect?

You are affected if you are running a version in the vulnerable range with MCP Composer enabled and a project configured for OAuth authentication, which lets externally reachable, unauthenticated requests to the streamable MCP transport read files and resources belonging to other users.