CVE-2026-7664CWE-287

Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

Critical · published June 22, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-06-22T14:10Z
EPSS history
Timeline
  • 22 JUN 14:10Z
    Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS
    cvelistv5