CVE-2026-8505

Langflow’s webhook defaults allowed unauthenticated runs with the flow owner’s privileges

Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

When webhook authentication was off, an external caller who knew an exposed flow’s identifier could start it with its owner’s permissions. The upstream project changed the default in April and removed the opt-out in November.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources describe possible unauthorized execution. CISA’s July 22 supplemental assessment recorded no exploitation at that time.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The webhook authentication setting allowed a request to take the flow owner’s identity without verifying the caller’s credentials.

Conditions required

The webhook is reachable, the caller knows the relevant flow identifier, and the deployment accepts unauthenticated webhook requests.

Potential impact

An unauthorized run could invoke whatever tools, data access and code the flow already allowed. The potential consequences depend on the flow’s configuration and execution privileges.

Affected versions and configurations

IBM lists Langflow OSS 1.0.0 through 1.10.0. The upstream advisory dates the default-off setting to versions 1.7.0 through 1.9.0.

Fix and mitigation status

Upstream 1.9.1 enabled authentication by default. IBM recommends 1.10.1 for its listed range. A separate change in 1.13.2 requires owner credentials even on systems configured to opt out.

Practical next steps

Apply the release appropriate to the deployed distribution. Verify that every webhook sender authenticates with credentials belonging to the flow owner, including callers that relied on the legacy opt-out.

Operating lesson

Audit saved settings when a release changes an authentication default, and verify how existing integrations identify their callers.

Evidence and limits

The public April 22 fix precedes IBM’s July 2 bulletin, the July 17 CVE publication and the August 12 upstream advisory. IBM and upstream identify different affected ranges. The November 9 change removes an explicitly configurable opt-out. It adds no evidence that the original CVE affects every release through 1.13.1.

Sources