[CVE-2026-7663] IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p…

Descripción técnica

IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

Puntuación CVSS

Score: 9.1/10 — Severidad: CRITICAL — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Productos afectados

Langflow — Langflow

Debilidades (CWE)

CWE-285, CWE-863

Fuente oficial

Publicado en NIST NVD.