Vulnerability intelligence

CVE-2026-7664

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

0.5%

Riskier than 42% of all CVEs · checked 2026-09-19

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Jun 25, 2026 · latest Jun 25, 2026

Coverage timeline

Critical IBM Langflow flaws let attackers run code remotely
securityonline.info · Jun 25, 2026

Related CVEs — IBM

CVE-2026-16346 CVE-2026-17102 CVE-2026-18169 CVE-2026-18163 CVE-2026-18162 CVE-2026-84064 CVE-2026-84078 CVE-2026-84075