CVE-2026-7663: IBM Langflow OSS: Incorrect Authorization in MCP Transport Endpoint
IBM disclosed CVE-2026-7663 in Langflow OSS versions 1.0.0 through 1.9.6, where improper authorization enforcement in the Streamable MCP transport endpoint may let unauthenticated attackers reach protected MCP project resources. NVD scores it 9.8 (CVSS 3.1, critical), while IBM's score in the record is 9.1. No confirmed exploitation or fixed version appears in the sources consulted.
Overview
CVE-2026-7663 is a critical issue classified as CWE-863 (Incorrect Authorization) in IBM Langflow OSS. According to the record, the Streamable MCP transport endpoint does not properly enforce authorization, which can allow unauthenticated attackers to access protected MCP project resources and run MCP operations. The vendor advisory listed in the record is the IBM support page 7277570.
Impact
- The CVSS 3.1 vector recorded by NVD rates confidentiality, integrity and availability as High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- The record states that unauthenticated attackers may access protected MCP project resources.
- The record states that unauthenticated attackers may execute MCP operations.
- The real business impact depends on which projects and data an instance hosts, and the record does not describe this.
Affected products and versions
- Product: Langflow OSS (listed in the record as Langflow Langflow).
- Range in the description: 1.0.0 through 1.9.6.
- Machine-readable range in the record: 1.0.0 or later and before 1.10.0.
- The record lists no fixed version. The absence of a listed fix does not mean no fix exists, so check the vendor advisory.
Exploitation status
The CISA KEV entry in the record shows this CVE is not listed. No confirmed exploitation or active exploitation appears in the sources consulted. The EPSS probability in the record is 0.0052 (percentile 0.42595), which is a statistical estimate and not evidence of attacks.
Remediation and mitigation
- Inventory all Langflow OSS deployments and their exact versions, including any instance that exposes the MCP transport endpoint.
- Consult the IBM advisory for current remediation guidance and any fixed release.
- Move to a release the vendor identifies as fixed. The record does not name one.
- Until a fix is applied, restrict network access to Langflow instances and limit exposure of the MCP endpoint to trusted networks.
- Review perimeter authentication for MCP resources as a temporary compensating measure. This is not a substitute for a vendor fix.
Detection guidance
- Review web and application logs for requests to the Streamable MCP transport endpoint that lack a valid authentication context.
- Alert on unusual request volume or unexpected MCP operations from unknown sources.
- Monitor MCP project configurations and resources for unexpected changes.
Limitations of the available information
- The record contains no fixed version, patch details or technical analysis of the attack path.
- The IBM score (9.1) and the NVD score (9.8) differ, and the record does not explain why.
- The description range (through 1.9.6) and the machine-readable range (before 1.10.0) are not worded identically, so confirm exact affected builds with the vendor.
- The record does not confirm whether any public exploit or in-the-wild activity exists beyond the KEV status shown.
Frequently asked questions
What is CVE-2026-7663?
It is a critical incorrect authorization flaw in IBM Langflow OSS versions 1.0.0 through 1.9.6. The Streamable MCP transport endpoint may let unauthenticated attackers access protected MCP project resources and run MCP operations.
Is there a fixed version available?
The record does not list a fixed version. Check the IBM support page listed in the record for current remediation guidance.
Is this vulnerability being exploited in the wild?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.