What is the CVSS score of CVE-2026-8446?

CVE-2026-8446 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by CVE-2026-8446?

IBM Langflow OSS versions 1.0.0-1.10.3 allow attackers to access confidential project data without authentication, creating a data breach risk for any organization deploying this tool with default…. A patch is available.

How to fix or mitigate CVE-2026-8446?

Within 24 hours, identify all systems running IBM Langflow OSS versions 1.0.0 through 1.10.3 and verify whether MCP composer is enabled with OAuth authentication-the default vulnerable configuration. Within 7 days, apply the vendor-released patch to all affected systems, upgrading to the patched version specified in IBM's security advisory. Within 30 days, audit authentication logs and access records from the preceding 90 days to detect unauthorized access attempts to project data endpoints, and establish a continuous monitoring policy for this vulnerability category.

IBM Langflow OSS CVE-2026-8446

EUVD-2026-53465 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-05 ibm

IBM Authentication Bypass Langflow Oss

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable endpoint, no attacker skill required once vulnerable config present, no credentials needed; impact is confidentiality only with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:21 vuln.today

CVE Published

Aug 05, 2026 - 16:27 cve.org

HIGH 7.5

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .

AnalysisAI

Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.3 exposes the Model Context Protocol (MCP) composer endpoint to unauthenticated remote access when projects are configured with auth_type=oauth and MCP composer is enabled - which is the default deployment state. An unauthenticated network attacker can reach the MCP composer endpoint and read confidential project data (C:H) without supplying valid credentials, entirely bypassing the OAuth authentication gate. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Langflow OSS instance

Delivery

Confirm MCP composer endpoint is accessible

Exploit

Send unauthenticated HTTP request to MCP composer path

Execution

Authentication check bypassed due to CWE-306

Impact

Read confidential project data

Access

Identify exposed Langflow OSS instance

Delivery

Confirm MCP composer endpoint is accessible

Exploit

Send unauthenticated HTTP request to MCP composer path

Execution

Authentication check bypassed due to CWE-306

Impact

Read confidential project data

Vulnerability AssessmentAI

Exploitation	Exploitation requires two concurrent conditions: (1) mcp_composer_enabled=true, which is the default Langflow OSS configuration meaning all default deployments are exposed unless explicitly disabled, and (2) individual projects configured with auth_type=oauth, which is a deliberate administrator or user choice per project rather than a global default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-severity, network-exploitable, unauthenticated vulnerability with significant confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker who can reach the Langflow OSS web interface sends an HTTP request directly to the MCP composer endpoint, which - due to the missing authentication check - responds without requiring a valid OAuth token. The attacker reads confidential AI workflow data, including any credentials, API keys, or sensitive context embedded in project configurations. …
Remediation	Apply the vendor-released patch per the IBM advisory at https://www.ibm.com/support/pages/node/7282147; the exact fixed version number is not specified in the available data and should be confirmed from that advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running IBM Langflow OSS versions 1.0.0 through 1.10.3 and verify whether MCP composer is enabled with OAuth authentication-the default vulnerable configuration. …

Threat intelligence, references, and detailed analysis are available after sign-in.