CVE-2026-7755 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow r… | CVSS 8.8 HIGH

Description

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.

Metadata

CVE ID: CVE-2026-7755
State: PUBLISHED
Assigner: ibm
Reserved: 2026-05-04 03:09 UTC
Published: 2026-07-17 19:18 UTC
Last updated: 2026-07-17 23:15 UTC
Vendor / Product: IBM / Langflow OSS
Sources: cve.org · NVD

Severity & Metrics

8.8 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
IBM	Langflow OSS	—	1.0.0 ≤ 1.10.0

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.8	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (1)

https://www.ibm.com/support/pages/node/7278932