Authentication bypass in IBM Langflow OSS (CVE-2026-8505)

CVE-2026-8505 is an authentication bypass vulnerability in IBM Langflow OSS whereby the webhook endpoint incorrectly skips API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False, which is the default setting. A remote, unauthenticated attacker who knows a flow's UUID can trigger execution of any flow as if they were the owner, potentially resulting in Remote Code Execution (RCE) or Denial of Service (DoS). Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 9.8 · our assessment: act_now Vendor advisory: https://www.ibm.com/support/pages/node/7278921 Details: https://vuln.today/cve/CVE-2026-8505