Unauthenticated Execution Risk in Langflow

A severe security flaw discovered in IBM Langflow OSS permits remote, unauthenticated attackers to trigger flow execution. The mechanism relies on a bypass of established webhook authentication protocols, exposing affected installations to significant operational risks.

Webhook Authentication Logic Failure

The core of the issue resides in the webhook authentication logic used across versions 1.0.0 through 1.10.0. The system fails to correctly enforce API key validation under specific configuration conditions. This oversight allows an actor to bypass security controls entirely if they possess a valid flow UUID.

Default Settings Expose Systems

The vulnerability is tied to the WEBHOOK_AUTH_ENABLE configuration variable. When this is set to False, which serves as the default state for the software, the application does not verify the identity of the requester. Consequently, a remote attacker can execute any flow as if they were the system owner. This condition can potentially lead to Remote Code Execution (RCE), providing attackers with unauthorized control over the workflow processes.

• Advisory Identifier: GHSA-9cc5-j3qq-69gv
• Affected Version Range: 1.0.0 through 1.10.0
• Severity Rating: Critical (CVSS 9.8)
• CVE Identifier: CVE-2026-8505

Implications for System Integrity

For organizations utilizing IBM Langflow OSS, the primary concern lies in the default configuration's lack of authentication. Because the system behaves in a way that allows arbitrary flow execution once the UUID is known, the potential for unauthorized process manipulation is high. This situation suggests that teams should verify their current configuration state to determine if the webhook authentication feature is enabled or disabled in their specific environment.