What’s Vulnerable › Vulnerabilities

CVE-2026-12763: Langflow is vulnerable to authentication bypass and insufficient session expiration

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-16
• Weakness: CWE-306

Description

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

Affected products

• IBM Langflow OSS: from 1.0.0 through 1.11.5

References

• https://www.ibm.com/support/pages/node/7286662

Get alerted when CVE-2026-12763 or the next vulnerability affects your stack