CVE-2026-7664: IBM Langflow Auth Bypass Vulnerability

CVE-2026-7664 Overview

CVE-2026-7664 is an authorization bypass vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.8.4. The flaw resides in the Streamable Model Context Protocol (MCP) transport endpoint, which fails to enforce authorization checks on inbound requests. Unauthenticated attackers can reach protected MCP project resources and invoke MCP operations over the network without credentials. The weakness is classified under [CWE-287] Improper Authentication and carries a CVSS v3.1 score of 9.8.

Critical Impact
Remote, unauthenticated attackers can access protected MCP project resources and execute MCP operations, exposing project data and runtime functionality to full compromise.

Affected Products

IBM Langflow OSS 1.0.0
IBM Langflow OSS versions 1.0.1 through 1.8.3
IBM Langflow OSS 1.8.4

Discovery Timeline

2026-06-22 - CVE-2026-7664 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-7664

Vulnerability Analysis

IBM Langflow OSS exposes a Streamable MCP transport endpoint to support agentic and tool-calling workflows. The transport endpoint accepts MCP operations targeting project-scoped resources. The vulnerable releases do not enforce authorization on incoming MCP requests before routing them to project resource handlers.

An attacker who can reach the endpoint over the network sends MCP protocol messages without authentication. The server processes those messages and returns or mutates project data. This grants the attacker the ability to read protected resources and execute operations that should require an authenticated, authorized session. The Exploit Prediction Scoring System (EPSS) currently rates exploitation probability low, but the network-reachable nature and unauthenticated access path raise practical risk for any internet-exposed deployment.

Root Cause

The root cause is missing authorization enforcement in the Streamable MCP transport handler. The handler accepts and dispatches MCP operations to project resources without validating the requestor's identity or permissions. This is a [CWE-287] failure where authentication and authorization controls are absent on a sensitive endpoint that mediates access to project data and tool invocations.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker locates a Langflow OSS instance exposing the MCP endpoint and sends crafted MCP protocol messages directly to the transport. The server executes the operations and returns project data or performs requested actions. Because MCP operations can include resource reads, tool invocations, and project mutations, the impact extends beyond information disclosure to integrity and availability of the Langflow workload.

No verified proof-of-concept code has been published. Refer to the IBM Security Advisory for technical details and fixed-version guidance.

Detection Methods for CVE-2026-7664

Indicators of Compromise

Unauthenticated HTTP requests to the Langflow Streamable MCP transport endpoint from external or unexpected internal sources
MCP tools/call, resources/read, or session-initialization messages arriving without a valid authorization header
Access to project resources from IP addresses that have never authenticated to the Langflow application
Unexpected outbound activity initiated by Langflow worker processes following anomalous MCP requests

Detection Strategies

Inspect Langflow application logs for MCP transport requests that succeed without an associated authenticated session identifier
Correlate web server access logs against authentication logs to identify MCP endpoint hits with no preceding login event
Deploy network signatures on reverse proxies that flag MCP protocol traffic to Langflow lacking an Authorization header

Monitoring Recommendations

Forward Langflow access logs, authentication logs, and reverse-proxy logs to a centralized analytics platform for correlation
Alert on spikes in MCP endpoint request volume, particularly from a single source address
Baseline normal MCP operation patterns per project and alert on deviations such as access to projects from new principals

How to Mitigate CVE-2026-7664

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release as identified in the IBM Security Advisory
Restrict network exposure of the Langflow MCP transport endpoint to trusted internal networks and authenticated proxies
Audit Langflow project access logs for unauthenticated MCP activity since deployment of any version between 1.0.0 and 1.8.4
Rotate any secrets, API tokens, or credentials stored in Langflow projects that may have been exposed

Patch Information

IBM has published remediation guidance and fixed versions in the IBM Security Advisory. Administrators running any version in the 1.0.0 through 1.8.4 range should upgrade to the patched release identified by IBM. Verify the upgrade by confirming MCP endpoints reject unauthenticated requests with an HTTP 401 response after patching.

Workarounds

Place the Langflow MCP endpoint behind an authenticating reverse proxy that enforces token or mTLS validation before request forwarding
Block external access to the MCP transport path at the network perimeter until the patched version is deployed
Disable the Streamable MCP transport feature in configuration if it is not required for the deployment

bash

# Example: restrict MCP endpoint with an Nginx reverse proxy auth_request
location /api/v1/mcp/ {
    auth_request /auth/validate;
    proxy_pass http://langflow_upstream;
    proxy_set_header X-Original-URI $request_uri;
}

location = /auth/validate {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}