CVE-2026-76649.8CriticalCWE-287

CVE-2026-7664: IBM Langflow OSS vulnerability

IBM · Langflow OSS

Vendor fix available · Affected: IBM Langflow OSS · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

0.5%probability of exploitation in the next 30 days

43rd percentile

050100

Higher than 43% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Authentication · Authentication
Vendor: IBM
Published: June 2026
Band: Unlikely (under 1%), June 2026

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 25 Jun.

25 Jun 02:20
Critical IBM Langflow flaws let attackers run code remotely
SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.