IBM Langflow MCP Composer Authentication Bypass

Technical Analysis

The vulnerability lies in the MCP composer endpoint of Langflow, which is enabled by default and intended to broker MCP server/tool composition for agent workflows. When projects use auth_type=oauth, the composer endpoint apparently fails to properly validate or enforce OAuth authentication checks, allowing requests to bypass the intended authorization flow. An attacker with network access to the endpoint could invoke composer operations without valid OAuth credentials, potentially enumerating, modifying, or invoking MCP tool configurations tied to a project. Because MCP composer endpoints mediate access to underlying tool servers and their capabilities, this bypass could let an attacker cross from an unauthenticated network position into the agent's tool-invocation layer, effectively gaining a foothold to manipulate or abuse connected MCP tools. No details are given on remote code execution, but unauthorized access to tool orchestration configuration is itself a significant boundary violation for agentic systems.

Affected Systems

IBM Langflow; protocols: MCP

Detection Signatures

• Requests to /mcp/composer or similar composer endpoints lacking expected OAuth bearer tokens or session validation
• Unexpected 200 OK responses on composer endpoints from unauthenticated or improperly authenticated clients
• Anomalous MCP composer API calls originating from IPs/users with no prior OAuth handshake in logs
• Configuration audits showing mcp_composer_enabled=true with auth_type=oauth and no supplemental access control

Remediation Steps

1. 1

   Upgrade Langflow

   Update to the patched Langflow release beyond 1.10.3 that addresses CVE-2026-8446 as soon as it is available from IBM.

2. 2

   Disable MCP composer if unused

   Set mcp_composer_enabled=false for projects that do not require MCP composer functionality to reduce exposed attack surface.

3. 3

   Enforce network-level controls

   Restrict access to the MCP composer endpoint via network segmentation, firewall rules, or API gateway authentication independent of Langflow's internal OAuth check.

4. 4

   Audit OAuth-configured projects

   Review all projects using auth_type=oauth for signs of unauthorized composer access in logs and rotate credentials/tokens as a precaution.

5. 5

   Monitor MCP endpoint traffic

   Implement logging and alerting on MCP composer endpoint calls to detect anomalous or unauthenticated access attempts post-patch.