PT-2026-51341 · Ibm · Langflow Oss

Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-7664

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.8.4

Description Improper authorization enforcement in the Streamable MCP transport endpoint allows unauthenticated attackers to access protected MCP project resources and execute MCP operations.

Recommendations Update IBM Langflow OSS to a version later than 1.8.4. Restrict access to the Streamable MCP transport endpoint to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-7664

Affected Products

Langflow Oss

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-7664 · Security Note
• https://twitter.com/VulmonFeeds/status/2069146285312012763 · Twitter Post
• https://ibm.com/support/pages/node/7277243 · Patch, Vendor Advisory