CVE-2026-105699 langflow-ai CVE debrief

Who should care

Defenders and administrators of Langflow installations should be aware of this vulnerability and take necessary actions to protect their systems. They should prioritize verifying their Langflow installations, monitoring for suspicious access, and implementing additional access controls if necessary. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and its impact on their systems.

Why it matters

CVE-2026-105699 is a high-severity vulnerability in Langflow that allows authenticated cross-project file disclosure. Defenders should prioritize verifying their Langflow installations, monitoring for suspicious access, and implementing additional access controls if necessary.

• Verification of Langflow installation version and potential update to 1.9.1 or later
• Monitoring for suspicious access to project files
• Implementation of additional access controls for project files if necessary
• Review and update of incident response plans to address potential file disclosure

Technical summary

The vulnerability in Langflow allowed authenticated users to access files from other projects due to unscoped MCP resource handlers. This issue, fixed in version 1.9.1, allowed the disclosure of private flow artifacts but did not modify victim files or stored flows. Affected deployments should be verified, and updates or mitigations should be planned through normal change control. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review.

Defensive priority

Defenders should prioritize verifying their Langflow installations and ensuring they are updated to version 1.9.1 or later. They should also monitor for any suspicious access to project files and implement additional access controls if necessary.

Recommended defensive actions

• Verify Langflow installation version and update to 1.9.1 or later if necessary
• Monitor for suspicious access to project files
• Implement additional access controls for project files if necessary
• Review and update incident response plans to address potential file disclosure
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fix. However, there is limited information on the exploitability of the vulnerability and no evidence of in-the-wild exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.