CVE-2026-12763 in Langflow
Summary
by MITRE • 09/15/2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in IBM Langflow versions 1.0.0 through 1.11.5 represents a critical flaw within the Multi-Client Protocol tools implementation, specifically stemming from inadequate session and context isolation mechanisms. As an authenticated attacker with access to the platform, this weakness allows for the unauthorized retrieval of sensitive data belonging to other users by exploiting improper cache key management. The core technical issue lies in how the application handles caching for MCP server contexts; rather than binding these cached states strictly to unique user identifiers or session tokens, the system utilizes a shared or poorly differentiated key structure that fails to enforce strict boundaries between distinct user sessions.
From an operational perspective, this lack of isolation means that when one authenticated user interacts with an MCP tool, the resulting context and associated data may be stored in a cache location accessible by subsequent requests from different users under specific conditions. An attacker can leverage this flaw by crafting requests that trigger the retrieval of cached responses intended for another victim. This effectively bypasses standard authentication checks because the application assumes the cached state is valid for the current requestor, leading to a severe breach of confidentiality where private user data, tool outputs, or internal system states are exposed without authorization.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-367 Time-of-check Time-of-use (TOCTOU) race conditions related to caching mechanisms. In the context of the MITRE ATT&CK framework, this behavior facilitates Data from Information Repositories via lateral movement or direct access techniques where an adversary exploits trust relationships within a system to pivot between user accounts and extract sensitive information without needing elevated privileges beyond basic authentication. The impact is particularly severe in multi-tenant environments where data segregation is paramount for compliance with standards such as GDPR or HIPAA, as it allows one tenant to窥视 another's operational context.
To mitigate this risk, immediate action should be taken by upgrading IBM Langflow to a version later than 1.11.5 where the cache key isolation logic has been corrected to strictly bind cached MCP server contexts to unique user session identifiers. Until an upgrade is feasible, administrators can implement network-level controls such as Web Application Firewalls that monitor for anomalous patterns in cache retrieval requests or enforce stricter rate limiting on tool execution endpoints. Additionally, reviewing application logs for unusual access patterns where a single IP address or authenticated session rapidly accesses disparate user contexts may help identify active exploitation attempts while permanent patches are being deployed.