CVE-2026-8505
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in webhook authentication logic that allows unauthenticated users to trigger execution of any flow when WEBHOOK_AUTH_ENABLE is set to False (default).
Risk Assessment
A remote attacker who knows a flow's UUID can execute it as the owner, potentially leading to remote code execution (RCE).
Recommendation
Update IBM Langflow OSS to version 1.10.1 or later, or enable webhook authentication (WEBHOOK_AUTH_ENABLE=True).
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE).