{
 "id": "AIR-2026-1125",
 "slug": "cve-2026-7664-improper-authorization-flaw-in-ibm-langflow-os",
 "title": "CVE-2026-7664: Improper authorization flaw in IBM Langflow OSS",
 "summary": "An improper authorization enforcement vulnerability in IBM Langflow OSS versions 1.0.0 through 1.8.4 permits unauthenticated attackers to access protected MCP project resources. Attackers can execute unauthorized MCP operations via the Streamable transport endpoint.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "agent_hijack"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow OSS"
 ],
 "incident_date": "2026-06-22",
 "incident_date_precision": "day",
 "first_reported": "2026-06-22",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7664",
   "publisher": "NVD",
   "title": "CVE-2026-7664: IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute…",
   "published_at": "2026-06-22"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-7664",
  "mcp",
  "authorization"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}