CVE-2026-7664: Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

Synopsis

An authentication bypass vulnerability affects IBM Langflow OSS versions 1.0.0 through 1.8.4, allowing unauthenticated remote attackers to reach protected MCP (Model Context Protocol) project resources through the Streamable MCP transport endpoint. The flaw is reachable over the network with no credentials required and no user interaction needed. Successful exploitation grants an attacker full read, write, and availability impact over the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to send HTTP requests to the Langflow MCP transport endpoint from any internet-accessible or internal network path.

• AuthenticationNot required

  No credentials of any kind are required; the flaw is an authorization bypass that allows completely unauthenticated requests to succeed.

• Victim interactionNot required

  The attacker sends requests directly to the service endpoint and does not need any user to click a link, open a file, or take any other action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no need to win a race condition or depend on specific memory layout or environmental factors.

Blast Radius

• Reads protected MCP project resources, including any data, model configurations, or credentials stored within reachable projects.
• Executes arbitrary MCP operations, allowing an attacker to invoke, modify, or delete workflows and pipeline components without restriction.
• Modifies or destroys persisted project state, corrupting Langflow flows or overwriting stored configurations.
• Disrupts availability of the Langflow service by triggering resource-exhausting or destructive MCP operations.