langflow-ai/langflow · error · HTTPException

Access denied for knowledge base '{kb_name}'.

Error message

Access denied for knowledge base '{kb_name}'.

What it means

Error "Access denied for knowledge base '{kb_name}'." thrown in langflow-ai/langflow.

Source

Thrown at src/backend/base/langflow/api/v1/knowledge_bases.py:206

def _validate_kb_path_containment(kb_user_path: Path, kb_path: Path, kb_name: str, username: str) -> None:
    """Raise 403 if kb_path is not contained within kb_user_path.

    Delegates the actual containment check to
    :func:`langflow.services.memory_base.kb_path_helpers.validate_kb_path`
    (introduced in #12417) so the traversal guard is defined in one
    place — but translates its ``ValueError`` into the 403 HTTPException
    expected by the KB routes and keeps the high-signal log line.
    """
    try:
        validate_kb_path(kb_user_path, kb_path)
    except ValueError as exc:
        logger.warning(
            "Path traversal attempt blocked: user=%s kb_name=%r resolved_path=%s",
            username,
            kb_name,
            kb_path,
        )
        raise HTTPException(
            status_code=403,
            detail=f"Access denied for knowledge base '{kb_name}'.",
        ) from exc


def _resolve_kb_path(kb_name: str, owner_user) -> Path:
    """Resolve and validate KB path against the KB *owner's* namespace.

    ``owner_user`` is the User whose ``username`` roots the KB directory —
    for owner-only requests this is ``current_user``; for cross-user share
    grants ``_guard_kb_action`` returns the resolved KB owner so the route
    reads the KB from the right user directory.

    Raises 500 if root path not configured.
    Raises 403 if path traversal is detected (kb_name escapes the user directory).
    Raises 404 if the KB directory does not exist.
    """
    kb_root_path = KBStorageHelper.get_root_path()

View on GitHub (pinned to 976ec789d2)

Solutions

1. Access the knowledge base with the owning user, or have the owner share it with you.

When it happens

Trigger: Occurs when a user without access rights attempts to read or modify the named knowledge base.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/83e3e03caa403c5c. Report an issue: GitHub.