CVE-2026-7664 - Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

Back Back to CVE browser

CRITICAL

Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

Published Jun 22, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.50%

Description

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

Affected products

Vendor IBM Product Langflow OSS Default
unknown
Affected
- ≥ 1.0.0, ≤ 1.8.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
IBM	Langflow OSS	unknown	Affected ≥ 1.0.0, ≤ 1.8.4

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.9.1 https://pypi.org/project/langflow/

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38281
Advisory
https://www.ibm.com/support/pages/node/7277243
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38281		Advisory
https://www.ibm.com/support/pages/node/7277243		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Jun 22, 2026

Updated Jun 23, 2026

Reserved May 1, 2026

Link CVE-2026-7664

CISA Vulnrichment

Updated Jun 23, 2026

NVD

Status Analyzed

Modified Jun 26, 2026

Link CVE-2026-7664

Red Hat

No data

ENISA EUVD

Assigner ibm

Published Jun 22, 2026

Updated Jun 23, 2026

Link EUVD-2026-38281

GitHub

No data