CVE-2026-8505
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.72% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- langflow (pip) >= 1.7.0, <= 1.9.0, fixed in 1.9.1 · GHSA-cf6m-vc3m-7cgm