What is the CVSS score of CVE-2026-9077?

CVE-2026-9077 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by CVE-2026-9077?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability allowing authenticated users to bypass access controls and write arbitrary configurations to IDE files on underlying host…. A patch is available.

How to fix or mitigate CVE-2026-9077?

Within 24 hours, identify all systems running Langflow in versions 1.0.0 through 1.10.3 and restrict access to affected instances. Within 7 days, apply the vendor-released patch to all Langflow deployments and verify successful upgrade. Within 30 days, conduct a security audit of IDE configuration files on all affected hosts to detect and remove any unauthorized MCP server configurations, and implement application-level access controls to restrict Langflow deployments to isolated development environments.

IBM Langflow OSS CVE-2026-9077

EUVD-2026-53463 HIGH

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-08-05 ibm

GHSA-wq3q-gcx9-xvm2

Authentication Bypass IBM Langflow Oss

8.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

vuln.today AI

8.5 HIGH

Low-privilege network-accessible auth bypass writing arbitrary configs to a subsequent host system justifies AV:N, PR:L, S:C, and I:H with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:21 vuln.today

CVE Published

Aug 05, 2026 - 16:24 cve.org

HIGH 8.5

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

AnalysisAI

Remote authenticated attackers can bypass localhost-only access restrictions in IBM Langflow OSS 1.0.0 through 1.10.3 to write arbitrary MCP (Model Context Protocol) server configurations to IDE configuration files on the underlying host system. The CVSS scope change (S:C) confirms this escapes the Langflow application boundary, enabling persistent manipulation of developer IDE environments on the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.

Technical ContextAI

IBM Langflow OSS is an open-source AI workflow orchestration platform that supports integration with Model Context Protocol (MCP) servers - a mechanism for registering tool-providing servers with compatible IDEs such as VS Code or Cursor. The vulnerability, rooted in CWE-807 (Reliance on Untrusted Inputs in a Security Decision), indicates that the localhost-only enforcement applied to the MCP server configuration endpoint depends on an attacker-controllable input rather than a trustworthy server-side check. An authenticated low-privilege user can manipulate this input to bypass the network-origin restriction and reach the configuration-writing functionality intended only for local access. The affected scope, per CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, covers all Langflow OSS releases from 1.0.0 through 1.10.3.

RemediationAI

A patch is confirmed available from IBM per the vendor advisory at https://www.ibm.com/support/pages/node/7282147; the exact patched release version is not specified in available intelligence data and must be confirmed directly from the IBM advisory before upgrading. As a compensating control prior to patching, restrict Langflow instance access strictly to fully trusted authenticated users and audit existing IDE configuration files (e.g., .vscode/mcp.json or equivalent) on hosts running Langflow for unexpected MCP server entries - note that removing malicious entries requires verifying they were not already loaded by an active IDE session. If the MCP server configuration feature is not operationally required, disabling or restricting it at the network layer (e.g., blocking access to the relevant API endpoint via a reverse proxy) reduces the attack surface at the cost of losing MCP integration functionality.