CVE-2026-12763

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

  • Published Sep 14, 2026
  • CVSS 4.2 medium
  • 0.1% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-12763 at the National Vulnerability Database