Dashboard / CVE-2026-12763

CVE-2026-12763

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 48/100
Published: 2026-09-14 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
langflow langflow 1.0.0 – 1.11.6

References & Advisories (1)

Bug Bounty Relevance

48 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

4.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

0.19%
Raw Score 0.001880
Percentile 8.5%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00188
2026-11-13
0.00188
2026-11-12
0.00188
2026-11-10
0.00188
2026-11-09
0.00188
2026-11-08
0.00188
2026-11-07
0.00188
2026-11-06
0.00188
2026-11-05
0.00188
2026-11-04
0.00188
2026-11-03
0.00188

Intelligence Sources

nvd ref →

External Links