IBM Security Bulletin: Authentication Bypass in Langflow Webhook (CVE-2026-8505)

IBM Security Bulletin: Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution Vulnerability Overview CVE ID: CVE-2026-8505 Description: A vulnerability in Langflow’s webhook authentication logic allows unauthenticated users to trigger the execution of any workflow. When the configuration is set to (the default setting), the system incorrectly bypasses API key verification, allowing remote attackers to execute workflows using known UUIDs as if they were the owners. This may lead to Remote Code Execution (RCE) or Denial of Service (DoS). CVSS Score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Products Affected Product: Langflow OSS Affected Versions: 1.0.0-1.10.0 Operating System: Windows, Linux, Mac OS Remediation Recommendation: IBM strongly recommends resolving this vulnerability immediately by upgrading Langflow OSS to version 1.10.1. Workarounds and Mitigations: None Additional Information Document Number: 7278921 Last Modified: July 2, 2026 Initial Release Date: July 2, 2026 References Complete CVSS v3 Guide On-line Calculator v3 Related Information IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgments Edward-x (YLChen-007) Revision History July 2, 2026: Initial Release Disclaimer According to the First Responder Community and Security Team (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry standard designed to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is," without any express or implied warranties, including but not limited to implied warranties of merchantability and fitness for a particular purpose. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM periodically updates component records for products in its portfolio. As part of this effort, IBM identifies vulnerabilities in previously unrecognized package/service inventories, regardless of their CVE dates. The inclusion of an older CVE ID does not indicate that the referenced product has been in use by IBM since that date, nor does it indicate that IBM knew of the vulnerability prior to that date. We strive to keep customers informed of relevant vulnerabilities as they become known. The "Affected Products and Versions" referenced in IBM Security Bulletins are intended to list only products and versions supported by IBM that have not passed their final end-of-support or warranty dates. Therefore, the omission of unsupported or extended-support products and versions from this security bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. The reference of one or more unsupported versions in this security bulletin does not impose an obligation on IBM to fix any unsupported or extended-support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Security Bulletin: Authentication Bypass in Langflow Webhook (CVE-2026-8505)

More from this source