CVE-2026-12763

Langflow MCP tools can reuse another user’s cached server context

IBM / Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

An authenticated user may receive MCP server context cached for another user.

Severity and exploitation evidence

Medium · 4.2/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed IBM bulletin and CNA record do not document malicious exploitation or an affected customer.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The MCP Tools shared cache key does not reliably separate authenticated users. A public change added user identity to the key and disabled shared caching without an identity.

Conditions required

A shared Langflow deployment serves different users and the affected MCP component reuses its cache.

Potential impact

A user can access another user’s server context. IBM does not identify a specific tool action or secret recovered through this flaw.

Affected versions and configurations

1.0.0 through 1.11.5, inclusive, according to IBM.

Fix and mitigation status

1.11.6 addresses this issue according to IBM.

Practical next steps

Upgrade to a supported release containing the 1.11.6 fix. Test repeated calls by two users who configure the same MCP server name.

Operating lesson

Include authenticated identity in every shared tool cache key.

Evidence and limits

The July 13 public patch describes the cache collision. IBM’s September 8 grouped bulletin assigns this CVE to the MCP Tools cache and gives the 1.11.6 upgrade. Deactivated-account API key reuse is a different entry in that bulletin.

Sources