CVE-2026-8505
CRITICAL
CVSS 9.8
langflow_oss
Verified Advisory
Authentication bypass in IBM Langflow OSS (CVE-2026-8505)
CVE-2026-8505 is an authentication bypass vulnerability in IBM Langflow OSS whereby the webhook endpoint incorrectly skips API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False, which is the default setting. A remote, unauthenticated attacker who knows a flow's UUID can trigger execution of any flow as if they were the owner, potentially resulting in Remote Code Execution (RCE) or Denial of Service (DoS).
Affected versions:
- 1.0.0-1.10.0
We recommend updating to: 1.10.1.
CVSS 9.8 · our assessment: act_now
Vendor advisory: https://www.ibm.com/support/pages/node/7278921
Details: https://vuln.today/cve/CVE-2026-8505
Verified by vuln.today against published advisories.
Affected versions
- – 1.0.0-1.10.0
Fixed in: 1.10.1
More advisories for langflow_oss
- CVE-2026-13446 – Hard-coded credentials in IBM Langflow OSS (CVE-2026-13446)
- CVE-2026-13445 – Insecure file path handling in IBM Langflow OSS (CVE-2026-13445)
- CVE-2026-13448 – Unauthenticated remote code execution in IBM Langflow (CVE-2026-13448)
- CVE-2026-14499 – OS command injection in IBM Langflow OSS Python Interpreter (CVE-2026-14499)
- CVE-2026-7667 – Path traversal in the API Request component of IBM Langflow OSS (CVE-2026-7667)
- CVE-2026-7754 – Server-side request forgery (SSRF) in IBM Langflow OSS (CVE-2026-7754)
- CVE-2026-7872 – Path traversal in Langflow OSS File component tar extraction (CVE-2026-7872)
- CVE-2026-7755 – Remote code execution in IBM Langflow OSS (CVE-2026-7755)