CVE-2026-7664

Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

CVSS 9.8 CRITICALEPSS 0.3%CWE-287

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

IBM · Langflow OSS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.ibm.com/support/pages/node/7277243