CVE-2026-7755: MCP Server Configuration Validator Bypass via File Upload API
Published Jul 2, 2026
·Updated
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.
Affected Software
6 affected components
IBM Langflow OSS>=1.0.0<=1.10.0
IBM Langflow OSS<=1.0.0-1.10.0
All of the following
Langflow Langflow>=1.0.0<1.10.1
Any of the following
Apple macOS
Linux Linux kernel
Microsoft Windows
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.1
Event History
Jul 2, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Jul 17, 2026
CVE Published
via MITRE·07:18 PM
Data Sourced
via MITRE·07:18 PM
RemedyDescriptionSeverity
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-7755?
The severity of CVE-2026-7755 is rated high with a score of 8.8.
2
What is the risk associated with CVE-2026-7755?
CVE-2026-7755 has a risk rating of 79.
3
How does CVE-2026-7755 affect IBM Langflow OSS?
CVE-2026-7755 allows for potential remote code execution due to inadequate validation of MCP server configuration files.
4
How can I fix CVE-2026-7755?
To fix CVE-2026-7755, ensure that proper validation mechanisms are enforced for MCP server configuration files.
5
Which versions of IBM Langflow OSS are affected by CVE-2026-7755?
CVE-2026-7755 affects IBM Langflow OSS versions 1.0.0 through 1.10.0.