AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-12763

IBM Langflow OSS: missing authentication

IBM

CVE-2026-12763 · Published Sep 14, 2026 · updated Nov 3, 2026

Medium4.2
No fix yet
IBM advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

Affected versions

PackageAffectedFixed in
Langflow OSS
Product
>= 1.0.0, <= 1.11.5No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-306

More IBM advisories

All IBM
Medium 6.8Sep 14IBM MQ: information disclosureCVE-2026-13265no fix yetHigh 7.1Sep 14IBM Business Automation Workflow containers and traditional: XML external entityCVE-2026-12756no fix yetMedium 5.4Sep 14IBM Cloud Pak for Business Automation: missing authorizationCVE-2026-12758no fix yetMedium 6.5Sep 14IBM Cloud Pak for Business Automation: denial of serviceCVE-2026-12759no fix yetCritical 9.6Sep 14IBM Langflow OSS: server-side request forgeryCVE-2026-12944no fix yetMedium 4.3Sep 14IBM Sterling Secure Proxy: improper authorizationCVE-2026-75792no fix yet