cyfenced.com →

[ CVE-2026-8505 · Published 17 Jul 2026 ]

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

CVSS 9.8 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.8

[ Description ]Official description

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE).

[ Fixes ]Fixes and patches

  • langflow 1.9.1Fixed version · GitHub Advisories · pip package langflow: upgrade to 1.9.1 or later (affected >= 1.7.0, <= 1.9.0)

[ Packages ]Affected open-source packages

[ References ]References