What is the CVSS score of EUVD-2026-53465?

EUVD-2026-53465 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by EUVD-2026-53465?

IBM Langflow OSS versions 1.0.0-1.10.3 allow attackers to access confidential project data without authentication, creating a data breach risk for any organization deploying this tool with default…. A patch is available.

How to fix or mitigate EUVD-2026-53465?

Within 24 hours, identify all systems running IBM Langflow OSS versions 1.0.0 through 1.10.3 and verify whether MCP composer is enabled with OAuth authentication-the default vulnerable configuration. Within 7 days, apply the vendor-released patch to all affected systems, upgrading to the patched version specified in IBM's security advisory. Within 30 days, audit authentication logs and access records from the preceding 90 days to detect unauthorized access attempts to project data endpoints, and establish a continuous monitoring policy for this vulnerability category.

IBM Langflow OSS EUVD-2026-53465

| CVE-2026-8446 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-05 ibm

Authentication Bypass IBM Langflow Oss

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable endpoint, no attacker skill required once vulnerable config present, no credentials needed; impact is confidentiality only with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:21 vuln.today

CVE Published

Aug 05, 2026 - 16:27 cve.org

HIGH 7.5

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .

AnalysisAI

Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.3 exposes the Model Context Protocol (MCP) composer endpoint to unauthenticated remote access when projects are configured with auth_type=oauth and MCP composer is enabled - which is the default deployment state. An unauthenticated network attacker can reach the MCP composer endpoint and read confidential project data (C:H) without supplying valid credentials, entirely bypassing the OAuth authentication gate. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor (IBM) has confirmed the issue and released a patch.

Technical ContextAI

IBM Langflow OSS is an open-source AI workflow composition platform that allows users to build pipelines integrating large language models and external tools. The Model Context Protocol (MCP) is an emerging AI integration protocol for exposing tools and context to LLM agents; Langflow exposes an MCP composer endpoint for this purpose. The root cause is CWE-306 (Missing Authentication for Critical Function): when mcp_composer_enabled=true (the default) and a project uses auth_type=oauth, the MCP composer endpoint fails to enforce the configured OAuth authentication scheme before serving requests. The affected CPE is cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*, spanning all releases from 1.0.0 to 1.10.3 inclusive.

RemediationAI

Apply the vendor-released patch per the IBM advisory at https://www.ibm.com/support/pages/node/7282147; the exact fixed version number is not specified in the available data and should be confirmed from that advisory before upgrading. As an immediate compensating control, disable the MCP composer feature by setting mcp_composer_enabled=false, which eliminates the vulnerable endpoint entirely at the cost of losing MCP composer functionality. Alternatively, if MCP composer must remain enabled, consider switching affected projects away from auth_type=oauth temporarily until patching is complete, though this changes the authentication model and may introduce separate risks depending on the replacement auth type. Network-layer controls such as restricting access to the Langflow service to trusted IP ranges can reduce exposure but do not fix the underlying authentication bypass.