What is the CVSS score of EUVD-2026-38281?

EUVD-2026-38281 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by EUVD-2026-38281?

IBM Langflow OSS versions 1.0.0-1.8.4 contain a critical authorization bypass that eliminates authentication barriers, enabling unauthenticated attackers to access, steal, or manipulate AI/ML…. A patch is available.

How to fix or mitigate EUVD-2026-38281?

Within 24 hours: Identify all systems running IBM Langflow OSS 1.0.0-1.8.4; take publicly accessible instances offline or restrict network access until patched. Within 7 days: Deploy vendor patches to upgrade all instances to version 1.8.5 or later per vendor advisory; validate in staging environment before production rollout. Within 30 days: Review access logs for unauthorized activity during the vulnerable window, audit network controls around Langflow deployments, and document any exposed credentials or data accessed.

IBM Langflow OSS EUVD-2026-38281

| CVE-2026-7664 CRITICAL

Improper Authentication (CWE-287)

2026-06-22 ibm

GHSA-4pf4-j777-cgmf

IBM Authentication Bypass Langflow Oss

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Streamable MCP endpoint is network-reachable and lacks auth enforcement, so AV:N/AC:L/PR:N/UI:N; unauthenticated MCP operations expose data and allow tool invocation, giving C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 16:01 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

AnalysisAI

Authorization bypass in IBM Langflow OSS 1.0.0 through 1.8.4 allows unauthenticated remote attackers to access protected Model Context Protocol (MCP) project resources and invoke MCP operations through the Streamable MCP transport endpoint. The CVSS 9.8 rating reflects unauthenticated network exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and the flaw is not currently listed in CISA KEV.

Technical ContextAI

IBM Langflow OSS is an open-source visual framework for building LLM-driven agent and workflow applications on top of LangChain, and exposes integrations through the Model Context Protocol (MCP) - a JSON-RPC style protocol for connecting LLM clients to tools and data sources. The vulnerable component is the Streamable MCP transport endpoint, which is supposed to authenticate callers before brokering access to MCP project resources and operations such as tool invocation. The root cause maps to CWE-287 (Improper Authentication): authorization enforcement on this transport is incomplete or missing, so requests arrive at protected MCP project resources without ever being tied to an authenticated identity. The affected CPE is cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, covering Langflow OSS releases 1.0.0 through 1.8.4 inclusive.

RemediationAI

Patch available per vendor advisory at https://www.ibm.com/support/pages/node/7277243 - administrators should upgrade IBM Langflow OSS to the fixed release identified by IBM (exact fixed version not stated in the input data, so confirm directly from the advisory) and avoid running any 1.0.0-1.8.4 build on reachable networks. Until the upgrade is applied, restrict network exposure of the Streamable MCP transport endpoint to trusted clients via firewall, reverse-proxy ACLs, or a service mesh policy, and place an authenticating proxy (mTLS or OAuth-aware gateway) in front of Langflow so unauthenticated requests cannot reach the MCP routes; the trade-off is that legitimate MCP clients must be reconfigured for the new auth layer. If MCP is not in active use, disable or remove the MCP integration entirely so the Streamable transport is not loaded, accepting that any flows depending on MCP tools will stop functioning.