IBM Langflow OSS CVE-2026-8505

Exploitation requires that the target run IBM Langflow OSS 1.0.0-1.10.0 with the WEBHOOK_AUTH_ENABLE configuration set to False - which is the DEFAULT, so no attacker-controlled reconfiguration is needed. The attacker must also know a valid flow UUID, and the flow's execution reaching RCE depends on that flow containing components capable of code/command execution. Limiting factors: the flow UUID is an unguessable identifier that the attacker must first obtain (via leak, logging, or shared links), the Langflow webhook endpoint must be network-reachable by the attacker, and setting WEBHOOK_AUTH_ENABLE=True fully closes the bypass. No user interaction or prior authentication is required against a default install.

This is a genuine high priority, not a paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes network-reachable, unauthenticated, no-interaction exploitation with full CIA impact, and the description confirms the vulnerable state (WEBHOOK_AUTH_ENABLE=False) is the DEFAULT - meaning stock deployments are exposed out of the box. The one meaningful gating factor is knowledge of a valid flow UUID: UUIDs are unguessable at random, so opportunistic mass-exploitation is harder than the AV:N/AC:L vector alone suggests, but UUIDs frequently leak via logs, browser history, referrers, shared links, API responses, or predictable export/import artifacts, so this is closer to a weak secret than a true authentication barrier. No EPSS score, KEV entry, or POC was provided: there is no evidence of active exploitation or published exploit code at this time, so real-world risk today is driven by exposure and patch latency rather than confirmed in-the-wild activity. Conflicting-signal note: the CVSS marks AC:L, but the practical requirement to obtain a flow UUID arguably warrants higher attack complexity - defenders should not assume trivial internet-wide scanning yields immediate compromise.

An attacker who has obtained a target flow's UUID - for example harvested from a leaked URL, log entry, or shared workspace export - sends a crafted HTTP POST to that flow's webhook endpoint on an internet-exposed Langflow instance running the default configuration. Because WEBHOOK_AUTH_ENABLE is False, the server skips API key validation and executes the flow as its owner; if the flow contains code-execution components, this yields arbitrary code execution on the host. No public exploit code was identified at time of analysis, but the low attack complexity and default-vulnerable state make weaponization straightforward once a UUID is known.