CVE-2026-7755

MCP Server Configuration Validator Bypass via File Upload API

High · published July 17, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00746 · 54.3th percentile
Published
2026-07-17T19:18Z
EPSS history
Timeline
  • 17 JUL 19:18Z
    MCP Server Configuration Validator Bypass via File Upload API
    cvelistv5