EUVD-2026-53465Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint, no attacker skill required once vulnerable config present, no credentials needed; impact is confidentiality only with no integrity or availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .
AnalysisAI
Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.3 exposes the Model Context Protocol (MCP) composer endpoint to unauthenticated remote access when projects are configured with auth_type=oauth and MCP composer is enabled - which is the default deployment state. An unauthenticated network attacker can reach the MCP composer endpoint and read confidential project data (C:H) without supplying valid credentials, entirely bypassing the OAuth authentication gate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) mcp_composer_enabled=true, which is the default Langflow OSS configuration meaning all default deployments are exposed unless explicitly disabled, and (2) individual projects configured with auth_type=oauth, which is a deliberate administrator or user choice per project rather than a global default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-severity, network-exploitable, unauthenticated vulnerability with significant confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker who can reach the Langflow OSS web interface sends an HTTP request directly to the MCP composer endpoint, which - due to the missing authentication check - responds without requiring a valid OAuth token. The attacker reads confidential AI workflow data, including any credentials, API keys, or sensitive context embedded in project configurations. … |
| Remediation | Apply the vendor-released patch per the IBM advisory at https://www.ibm.com/support/pages/node/7282147; the exact fixed version number is not specified in the available data and should be confirmed from that advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM Langflow OSS versions 1.0.0 through 1.10.3 and verify whether MCP composer is enabled with OAuth authentication-the default vulnerable configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Langflow Oss
View allUnauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execu
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sa
Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to e
Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 stems from broken webhook authentication
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today