Description

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-14T21:17:00.440Z",
  "pubdate": "2026-09-14T21:17:00.440Z",
  "executiveSummary": "A critical vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.11.5 stemming from improper cache key isolation within the MCP (Model Context Protocol) Tools component.\nThis vulnerability allows an authenticated attacker to bypass intended access controls and gain unauthorized access to the MCP server context belonging to another user.\nThe flaw stems from a failure to sufficiently incorporate user-specific identifiers into the cache key generation logic, causing the application to return cached data belonging to one user session to an unauthorized requestor.\nThe risk implication is significant, as it leads to cross-user data leakage and potential unauthorized execution of tools within the context of an unintended MCP server.\nExploitation requires the attacker to be an authenticated user within the system, but does not require administrative privileges, effectively allowing horizontal privilege escalation within the multi-tenant environment.",
  "technicalDetails": "The vulnerability resides within the MCP Tools component of IBM Langflow OSS, specifically in the logic responsible for caching MCP server discovery and interaction data.\nThe root cause is identified as improper implementation of cache key isolation. When the system retrieves or executes functions via an MCP server, it utilizes a caching mechanism to improve performance and reduce latency in tool invocation.\nIn the affected versions (1.0.0 through 1.11.5), the key generation algorithm for the cache does not include the unique user session identifier or tenant context in the hashing or key formation process. Consequently, the cache key becomes global or shared across multiple users rather than being scoped to the specific user session.\nThe attack flow proceeds as follows: 1) A legitimate user interacts with their designated MCP server, prompting the system to store sensitive server configurations or context data in the cache. 2) An authenticated malicious actor subsequently requests tool access or server context information that overlaps with the cached key parameters. 3) The application, identifying a match in the cache, returns the previously stored MCP server context without validating ownership or verifying that the cached item is tied to the current requester.\nThis allows the attacker to intercept and utilize the MCP server configuration, potentially leading to unauthorized data access or the ability to execute tools on a remote server that the attacker was not authorized to interact with.\nSince the MCP protocol often facilitates external tool interaction, this vulnerability can expose sensitive backend infrastructure or proprietary data workflows associated with another user's MCP implementation.\nThe flaw exists entirely within the internal server-side caching logic of the MCP Tools component. Because it depends on the presence of existing cached data generated by another user, the vulnerability is a form of session/context pollution where the system fails to maintain strict boundaries between multi-tenant interactions.\nNo specific network-level bypass is required, as the exploitation occurs through legitimate API interactions that leverage the flawed caching layer, effectively treating the attacker as an authorized user viewing another user's cached session data."
}