CVE-2026-12763: IBM Langflow OSS Auth Bypass Vulnerability

CVE-2026-12763 Overview

CVE-2026-12763 affects IBM Langflow OSS versions 1.0.0 through 1.11.5. The vulnerability allows an authenticated attacker to access another user's Model Context Protocol (MCP) server context because of improper cache key isolation in the MCP Tools component. The flaw is classified under [CWE-306] and impacts confidentiality and integrity of tenant data within multi-user Langflow deployments.

Critical Impact
Authenticated users can read or influence MCP server context belonging to other tenants, exposing prompt data, tool invocations, and downstream AI workflow state.

Affected Products

IBM Langflow OSS 1.0.0 through 1.11.5
Deployments using the MCP Tools component
Multi-user Langflow environments sharing a cache backend

Discovery Timeline

2026-09-14 - CVE-2026-12763 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-12763

Vulnerability Analysis

IBM Langflow OSS integrates a Model Context Protocol (MCP) Tools component that brokers requests between Langflow flows and MCP servers. The component caches MCP server context to reduce round-trips and improve response latency. The cache key generation does not sufficiently incorporate the requesting user's identity or session boundary. As a result, one authenticated user can retrieve a cached MCP context entry that was populated by a different user.

Exploitation requires an authenticated session and specific timing where a target user's context is already cached. The attacker triggers an MCP Tools operation whose cache lookup collides with the victim's entry. The returned context can include tool listings, invocation state, and intermediate data associated with the victim's flow.

Root Cause

The root cause is missing tenant scoping in the cache key used by the MCP Tools component. The cache key derives from MCP server identifiers and tool parameters rather than a composite key that binds the entry to a user, workspace, or session token. This design choice violates isolation between authenticated principals sharing the same Langflow instance.

Attack Vector

The attack vector is network-based against the Langflow application interface. The attacker must hold valid credentials for the same Langflow instance as the victim. The attacker issues MCP Tools requests crafted to produce cache key collisions with the victim's cached context. No user interaction from the victim is required beyond normal usage that populates the cache.

No public exploit code is available for CVE-2026-12763. See the IBM Support Page for vendor technical detail.

Detection Methods for CVE-2026-12763

Indicators of Compromise

Unexpected MCP Tools responses containing context, tool lists, or parameters that do not match the requesting user's flows.
Application logs showing repeated MCP Tools cache hits originating from users that have no legitimate association with the referenced MCP server.
Anomalous access patterns where one account rapidly enumerates MCP server identifiers or tool names.

Detection Strategies

Correlate MCP Tools request logs with user identity, workspace, and target MCP server. Flag cases where returned context references resources outside the caller's ownership.
Enable verbose audit logging on the MCP Tools component and compare cache lookup keys against the requesting principal.
Baseline typical MCP call volume per user and alert on sudden spikes that suggest enumeration.

Monitoring Recommendations

Ship Langflow application and access logs to a centralized analytics platform for retention and correlation.
Monitor authentication events on the Langflow instance for unusual account creation or credential reuse.
Track outbound calls from Langflow to MCP servers and alert on unexpected tool invocations tied to sensitive workflows.

How to Mitigate CVE-2026-12763

Immediate Actions Required

Inventory all IBM Langflow OSS deployments and identify instances running versions 1.0.0 through 1.11.5.
Restrict Langflow access to trusted users only until a patched version is deployed.
Rotate any credentials, API keys, or tokens that may have been exposed through cached MCP context.

Patch Information

Refer to the IBM Support Page for CVE-2026-12763 for the fixed release and upgrade instructions. Upgrade all affected Langflow OSS instances to the vendor-designated fixed version. Validate the MCP Tools component behavior after the upgrade to confirm cache entries are properly scoped per user.

Workarounds

Disable the MCP Tools component or remove MCP server configurations if the functionality is not required.
Segregate tenants across separate Langflow instances so cache collisions cannot cross trust boundaries.
Reduce or disable MCP context caching if the configuration allows, accepting the performance tradeoff until patched.

bash

# Configuration example
# Verify the installed Langflow version before and after remediation
pip show langflow | grep -i version

# Upgrade to the vendor-fixed release (replace X.Y.Z with the fixed version from IBM)
pip install --upgrade "langflow==X.Y.Z"