CVE-2026-12763CWE-306

CVE-2026-12763

Medium · published September 15, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-15T01:17Z
References (1)
https://www.ibm.com/support/pages/node/7286662 · [email protected]
EPSS history
Timeline
  • 16 SEP 04:25Z
    EPSS moved — → 0%
    epss
  • 14 SEP 20:32Z
    Langflow is vulnerable to authentication bypass and insufficient session expiration
    cvelistv5