CVE-2026-7664

Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

CVSS 9.8 CRITICALEPSS 0.3%CWE-287

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

22 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

IBM · Langflow OSS

References

https://www.ibm.com/support/pages/node/7277243