CVE-2026-7663: Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass

Synopsis

An authentication bypass vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.9.6) allows unauthenticated remote attackers to reach the Streamable MCP transport endpoint without presenting credentials. The flaw stems from improper authorization enforcement on that endpoint, meaning any attacker who can reach the service over the network can access protected MCP project resources and execute MCP operations across user accounts. Successful exploitation gives an attacker full read and write access to MCP resources, enabling cross-user data disclosure and unauthorized tool execution. No upstream fix is published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Langflow OSS service over the network; the vulnerable Streamable MCP transport endpoint is exposed via standard HTTP, making any internet- or intranet-facing deployment a viable target.

• AuthenticationNot required

  No credentials or account are needed; the authorization check on the affected endpoint is entirely absent, so an anonymous request is sufficient to access protected resources.

• Victim interactionNot required

  No user action is required; the attacker sends requests directly to the endpoint without needing to trick or involve any legitimate user.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring no race conditions, memory layout knowledge, or other environmental prerequisites beyond network access.

Blast Radius

• Reads protected MCP project resources belonging to any user, including configuration data, stored prompts, and project-scoped secrets.
• Executes MCP operations on behalf of other users, allowing the attacker to invoke tools and workflows they do not own or have permission to use.
• Performs cross-user data access at scale, since the single unauthenticated endpoint exposes resources across all projects on the instance.
• Availability is not directly impacted per the CVSS vector, but unauthorized tool execution may produce side effects such as triggering downstream API calls or consuming rate-limited resources.