Disclosed weakness · no CVE recorded

Langflow MCP batch actions can bypass tool exclusions and inherit credentials

Langflow · Agentic MCP HTTP batch and login

First documented disclosure · Review checkpoint

Summary

A batch can reach excluded actions, and a login to an explicitly supplied server can inherit process credentials.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The maintainer supplied regression tests. The reviewed sources do not document hostile use or a compromised customer.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

HTTP batch dispatch did not enforce all tool exclusions. Login could inherit the process API key or global headers when given a new destination, and clients or component registries could be shared across requests.

Conditions required

Access to the affected batch or login path. Secret exposure requires configured credentials and an explicit destination capable of receiving the request.

Potential impact

An unintended server could receive credentials or a batch could invoke an excluded operation. The maintainer’s tests cover these paths and request-state isolation.

Affected versions and configurations

Pre-fix code on the 1.13 and 1.12 release lines. An exact first affected version is not documented in the reviewed sources.

Fix and mitigation status

1.13.1, or the 1.12.9 backport on the 1.12 line. Both final packages were published November 4.

Practical next steps

Upgrade to 1.13.1 or the 1.12.9 backport. Review explicit-URL login destinations and rotate any process credentials sent to an untrusted destination.

Operating lesson

Apply the same authorization rules inside batches and bind outbound credentials to the exact server they were issued for.

Evidence and limits

The issue date is the public fix proposal. The November 4 package release is the remediation milestone. The reviewed maintainer records give no exact CVE mapping or CVSS score.

Sources