What is the CVSS score of CVE-2026-7663?

CVE-2026-7663 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow OSS are affected by CVE-2026-7663?

IBM Langflow OSS versions 1.0.0 through 1.9.6 contain a critical authentication bypass (CVE-2026-7663, CVSS 9.8) enabling unauthenticated remote attackers to access protected resources and execute…. A patch is available.

How to fix or mitigate CVE-2026-7663?

Within 24 hours: Inventory all Langflow OSS instances and identify those running versions 1.0.0-1.9.6; segregate affected systems from untrusted networks if patching cannot occur immediately. Within 7 days: Patch available per vendor advisory; upgrade all vulnerable instances to the patched version specified in IBM's official Langflow OSS security advisory. Within 30 days: Validate patch deployment across all instances and audit system logs for evidence of unauthorized access during the vulnerability exposure window.

IBM Langflow OSS CVE-2026-7663

EUVD-2026-40384 CRITICAL

Improper Authorization (CWE-285)

2026-06-30 ibm

GHSA-5wjx-cxqm-p8r4

Authentication Bypass IBM Langflow Oss

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable MCP endpoint with no authentication or interaction (AV:N/AC:L/PR:N/UI:N); missing authorization yields unauthorized resource access and operation execution, supporting high confidentiality and integrity, with availability high retained per vendor rating.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jul 02, 2026 - 18:22 NVD

9.1 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 19:53 vuln.today

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

AnalysisAI

Improper authorization enforcement in IBM Langflow OSS 1.0.0 through 1.9.6 lets unauthenticated remote attackers reach protected MCP (Model Context Protocol) project resources and invoke MCP operations through the Streamable MCP transport endpoint. Because the flaw bypasses authentication entirely on a network-facing endpoint and is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, any exposed Langflow instance is at risk. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.24%, 15th percentile), indicating exploitation has not yet become widespread.

Technical ContextAI

Langflow OSS is an open-source, IBM-maintained low-code visual framework for building LLM-driven agents and workflows, which exposes tools and data to AI clients via the Model Context Protocol (MCP). The vulnerability lives in the Streamable HTTP MCP transport endpoint, the server-sent/streaming channel MCP clients use to call project-scoped tools and resources. The root cause is CWE-285 (Improper Authorization): the endpoint fails to enforce the authorization checks that should gate access to a given MCP project, so requests that should require an authenticated, authorized identity are honored regardless. In effect the authorization decision is missing or incorrectly applied at the transport layer, allowing operation-level access to resources scoped to other users' or projects' MCP servers.

RemediationAI

Patch available per vendor advisory: IBM has released a fix, so upgrade Langflow OSS to the vendor-specified fixed release above 1.9.6 as documented at https://www.ibm.com/support/pages/node/7277570 (consult that advisory for the exact patched version, which is not enumerated in the available data). As an interim compensating control until patching, restrict network reachability of the Streamable MCP transport endpoint - place Langflow behind an authenticating reverse proxy or gateway that enforces identity before requests reach the endpoint, and block direct inbound access to the MCP port from untrusted networks; the trade-off is that legitimate remote MCP clients must be routed through the proxy and re-authenticated. Where MCP project exposure is not required, disable or do not expose the MCP server feature for sensitive projects, accepting the loss of remote MCP tool access. Avoid exposing Langflow directly to the internet.