CVE-2026-7663: Langflow auth bypass

CISO Take

IBM Langflow versions 1.0.0 through 1.9.6 fail to enforce authorization on the Streamable MCP transport endpoint, letting an unauthenticated network attacker access protected MCP project resources and execute MCP operations directly. This is a textbook CVSS 9.8 auth bypass (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity, and availability impact — no credentials or user interaction required to reach the exposed endpoint. It is not yet in CISA KEV and sits in the top 83% EPSS percentile, so exploitation is plausible but not confirmed as active in the wild, and no public exploit or Nuclei template exists today, which buys defenders a window. Langflow is a widely deployed agent/workflow orchestration framework, so any exposed MCP endpoint effectively hands an attacker the ability to invoke agent tools and pull project data as if authenticated. Upgrade to a patched Langflow release beyond 1.9.6 immediately, and until patched, restrict or firewall the Streamable MCP transport endpoint from untrusted networks and audit access logs for unauthenticated MCP calls.

Sources: NVD EPSS ATLAS

What is the risk?

Critical risk given the combination of network-reachable exposure, zero authentication requirement, zero user interaction, and full CIA impact (CVSS 9.8). The improper authorization enforcement (CWE-285, listed twice reflecting both the missing check and its scope) means any attacker who can reach the Streamable MCP endpoint over the network inherits the privileges of a legitimate MCP client. Mitigating factors are the absence of a public exploit, no known Nuclei scanning template, and no CISA KEV listing, which suggests exploitation is not yet mass-automated. However, the EPSS top-83% percentile signals meaningful attacker interest is plausible, and once a PoC surfaces, the low attack complexity makes weaponization trivial. Organizations exposing Langflow's MCP transport to the internet or shared networks face an immediate risk of unauthorized data access and unauthorized agent tool execution.

How does the attack unfold?

Initial Access

Attacker identifies and connects to a Langflow instance's Streamable MCP transport endpoint without any credentials.

AML.T0049

Authorization Bypass

Improper authorization enforcement on the endpoint lets the request through as if it came from an authenticated MCP client.

AML.T0012

Discovery

Attacker enumerates protected MCP project resources and available agent tools exposed via the endpoint.

AML.T0084

Impact

Attacker executes MCP operations to exfiltrate project data or invoke connected agent tools against downstream systems.

AML.T0053

Initial Access

Attacker identifies and connects to a Langflow instance's Streamable MCP transport endpoint without any credentials.

AML.T0049

Authorization Bypass

Improper authorization enforcement on the endpoint lets the request through as if it came from an authenticated MCP client.

AML.T0012

Discovery

Attacker enumerates protected MCP project resources and available agent tools exposed via the endpoint.

AML.T0084

Impact

Attacker executes MCP operations to exfiltrate project data or invoke connected agent tools against downstream systems.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Patch Langflow to a version beyond 1.9.6 that enforces authorization on the Streamable MCP transport endpoint — track IBM's advisory (referenced below) for the exact fixed release. Until patched, do not expose the Langflow MCP transport endpoint directly to untrusted networks; place it behind a VPN, reverse proxy with authentication, or network ACLs restricting access to known MCP clients only. Audit Langflow instance logs for unauthenticated requests to the MCP transport endpoint and unexpected MCP tool invocations as an indicator of exploitation attempts. Inventory which MCP tools are configured in each Langflow project and rotate any credentials or API keys those tools reference, since an attacker with MCP access could have invoked them. Monitor for the emergence of a public PoC or Nuclei template, as this would sharply raise near-term exploitation likelihood.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Code Execution Framework Agent Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security controls

NIST AI RMF

GOVERN-1.1 / MAP-3 - Risk Management and System Access Controls

OWASP LLM Top 10

LLM06 - Excessive Agency / Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-7663?

IBM Langflow versions 1.0.0 through 1.9.6 fail to enforce authorization on the Streamable MCP transport endpoint, letting an unauthenticated network attacker access protected MCP project resources and execute MCP operations directly. This is a textbook CVSS 9.8 auth bypass (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity, and availability impact — no credentials or user interaction required to reach the exposed endpoint. It is not yet in CISA KEV and sits in the top 83% EPSS percentile, so exploitation is plausible but not confirmed as active in the wild, and no public exploit or Nuclei template exists today, which buys defenders a window. Langflow is a widely deployed agent/workflow orchestration framework, so any exposed MCP endpoint effectively hands an attacker the ability to invoke agent tools and pull project data as if authenticated. Upgrade to a patched Langflow release beyond 1.9.6 immediately, and until patched, restrict or firewall the Streamable MCP transport endpoint from untrusted networks and audit access logs for unauthenticated MCP calls.

Is CVE-2026-7663 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-7663, increasing the risk of exploitation.

How to fix CVE-2026-7663?

Patch Langflow to a version beyond 1.9.6 that enforces authorization on the Streamable MCP transport endpoint — track IBM's advisory (referenced below) for the exact fixed release. Until patched, do not expose the Langflow MCP transport endpoint directly to untrusted networks; place it behind a VPN, reverse proxy with authentication, or network ACLs restricting access to known MCP clients only. Audit Langflow instance logs for unauthenticated requests to the MCP transport endpoint and unexpected MCP tool invocations as an indicator of exploitation attempts. Inventory which MCP tools are configured in each Langflow project and rotate any credentials or API keys those tools reference, since an attacker with MCP access could have invoked them. Monitor for the emergence of a public PoC or Nuclei template, as this would sharply raise near-term exploitation likelihood.

What systems are affected by CVE-2026-7663?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, workflow orchestration pipelines.

What is the CVSS score for CVE-2026-7663?

CVE-2026-7663 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationsworkflow orchestration pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN-1.1 / MAP-3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

Exploitation Scenario

An attacker scans for internet-facing or internal Langflow deployments and identifies the Streamable MCP transport endpoint, which normally requires authentication to reach project-scoped MCP resources. Due to the improper authorization enforcement, the attacker sends unauthenticated MCP protocol requests directly to this endpoint and is granted the same access as a legitimate authenticated MCP client, without needing credentials or any user interaction. From there, the attacker enumerates the project's connected MCP tools and resources, then invokes MCP operations to exfiltrate sensitive configuration or data, or to trigger tool calls that reach into connected systems (databases, file stores, third-party APIs) that the Langflow agent was authorized to use. The attack requires no social engineering and no prior foothold — only network reachability to the endpoint — making it attractive for opportunistic scanning once technical details or a PoC become public.

Weaknesses (CWE)

CWE-285 Improper Authorization Primary CWE-285 Improper Authorization

CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.

Source: MITRE CWE corpus.