CVE-2026-7663: ibm langflow oss Improper Authorization
CVSS: 9.8v3.1CriticalAnalyzed
Published 30-06-2026Last modified 01-07-2026
Vulnerability summary
CVE-2026-7663 is a critical (CVSS 9.8) Improper Authorization vulnerability in ibm langflow oss. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.2% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 30-06-2026PublishedVulnerability first disclosed.
- 01-07-2026Last modifiedVulnerability information updated.
Description
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources2 sources · 9.1–9.8
- CVE.orgCNA9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 21-09-2026
21-09-202621-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Ibm1 product
- langflow oss≥ 1.0.0, ≤ 1.9.6
Langflow1 product
- langflow≥ 1.0.0, < 1.10.0
2 vendors · 2 products