CVE-2026-7664

critical · 9.8

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

9.8

CVSS

0.5%

EPSS (exploit prob.)

42nd

EPSS percentile

2026-06-22

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
langflow	langflow	>= 1.0.0, <= 1.8.4

Check a specific version with /api/v1/cve/match.

References

https://www.ibm.com/support/pages/node/7277243

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-7664