CVE-2026-7664

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Jun 22, 2026

CISA due date

—

The record

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

Affected packages

Ecosystem	Package	Introduced	Fixed