Why it matters
Langflow is a widely used low-code platform for building LLM/agent workflows; cross-user MCP context leakage in a multi-tenant deployment exposes one user's connected-tool session and potentially credentials/data to another authenticated user — a meaningful confidentiality break in shared Langflow instances.
Attack vector
Improper cache-key isolation in the MCP Tools component allows an authenticated attacker to access another user's MCP server context — i.e., session/tool state belonging to a different user is retrievable due to shared/collision-prone cache keys.
Affected systems
IBM Langflow OSS 1.0.0 – 1.11.5
Mitigation
Consult IBM's support bulletin for the fixed version and upgrade path; restrict multi-tenant Langflow deployments until patched.