{"data":{"id":"d7f2c1f0-4cb4-4df3-925a-65be73010137","title":"CVE-2026-7663: IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources…","summary":"CVE-2026-7663 affects IBM Langflow OSS versions 1.0.0 through 1.9.6. The flaw is improper authorization enforcement in the Streamable MCP transport endpoint, which allows unauthenticated attackers to access protected MCP project resources and execute MCP operations. The weakness is classified as CWE-285 (Improper Authorization), and NVD had not yet provided an assessment at the time of publication.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7663","publishedAt":"2026-06-30T20:17:31.280Z","cveId":"CVE-2026-7663","cweIds":["CWE-285"],"cvssScore":"9.1","cvssSeverity":"critical","severity":"critical","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS unauthenticated access to MCP project resources","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0052,"epssCheckedAt":"2026-10-14T18:05:58.741Z","kevDateAdded":null,"advisoryAliases":["GHSA-5wjx-cxqm-p8r4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:47:14.424Z","patchAvailable":null,"disclosureDate":"2026-06-30T20:17:31.280Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}