CVE-2026-12763

Langflow is vulnerable to authentication bypass and insufficient session expiration PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.11.5

CWE

CWE-306

References

https://www.ibm.com/support/pages/node/7286662

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.