Unauthenticated Access to MCP Resources in IBM Langflow OSS

Executive Summary

CVE-2026-7663 is an improper authorization vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.6. It exists in the Streamable MCP transport endpoint, which allows unauthenticated attackers to bypass project ownership controls and execute Model Context Protocol (MCP) operations on projects owned by other users.

This flaw enables attackers to enumerate private MCP tool metadata, read confidential project files and flow definitions, access user-level files uploaded by the superuser, and execute MCP tools anonymously with superuser privileges. The vulnerability represents a complete bypass of the application's authorization model for MCP operations in the affected transport path.

Exploitation requires network access to a Langflow instance with MCP Composer enabled and target projects using OAuth or non-apikey authentication mode, with no user interaction or authentication required.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to private and confidential project data, such as MCP tool metadata, project files, and flow definitions.

Attackers can also access user-level files uploaded by the superuser and execute MCP tools with superuser privileges anonymously, potentially leading to unauthorized operations and data exposure.

Because the vulnerability allows a complete bypass of authorization controls without requiring authentication, it poses a high risk of data breach and unauthorized manipulation of project resources.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to access and execute operations on protected project resources, including reading confidential project files and user-level files with superuser privileges. This unauthorized access to sensitive data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Since the flaw enables bypassing authorization controls and exposing confidential data without authentication, affected organizations using IBM Langflow OSS versions 1.0.0 through 1.9.6 may face compliance risks related to unauthorized data disclosure and lack of proper access controls mandated by these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized access to the Streamable MCP transport endpoint at /api/v1/mcp/project/{project_id}/streamable. Detection would involve monitoring or testing access to this specific endpoint without authentication.

Since exploitation requires network access to a Langflow instance with MCP Composer enabled and OAuth/non-apikey authentication mode, detection could include attempting to access the endpoint anonymously to see if project resources or MCP operations can be accessed or executed.

However, no specific detection commands or tools are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

IBM strongly recommends upgrading Langflow OSS to version 1.10.0 to remediate this vulnerability.

No workarounds or mitigations are available other than upgrading.

Useful 0 Not Useful 0