Vulnerability intelligence

CVE-2026-7664

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

0.5%

Riskier than 40% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Jun 25, 2026 · latest Jun 25, 2026

Coverage timeline

Critical IBM Langflow flaws let attackers run code remotely
securityonline.info · Jun 25, 2026