{"schema":"threatline.record/2","record":{"id":"CVE-2026-8505","aliases":["GHSA-cf6m-vc3m-7cgm","PYSEC-2026-4233"],"summary":"Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass","details":"### Summary\nA vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the `WEBHOOK_AUTH_ENABLE` configuration is set to `False`. This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE) or Denial of Service (DoS).\n\n### Details\nThe `WEBHOOK_AUTH_ENABLE` setting was introduced in v1.7.0 (#9139) with a default of `False`. The root cause is in the webhook authentication path, `AuthService.get_webhook_user` (`src/backend/base/langflow/services/auth/service.py`; the thin wrapper in `src/backend/base/langflow/services/auth/utils.py` just delegates to it):\n\n```python\nasync def get_webhook_user(self, flow_id: str, request: Request) -> UserRead:\n    settings_service = self.settings\n    ...\n    # VULNERABILITY: If this setting is False (default in <= 1.9.0), it returns\n    # the flow owner WITHOUT checking the API Key in the request.\n    if not settings_service.auth_settings.WEBHOOK_AUTH_ENABLE:\n        try:\n            flow_owner = await get_user_by_flow_id_or_endpoint_name(flow_id)\n            return flow_owner\n```\n\nBy default (v1.7.0 through v1.9.0), Langflow treats `WEBHOOK_AUTH_ENABLE` as `False`, meaning all webhook endpoints are public. This relies exclusively on the secrecy of the `flow_id` (UUID), which is an insecure practice (Security by Obscurity).\n\nA related report, GHSA-6g4m-v5q2-475v, demonstrated a concrete RCE chain through this same bypass using the `PythonCodeStructuredTool` component (`exec()` on flow-authored Python code). That report is a duplicate of this root cause and has been closed in favor of this advisory; credit for that PoC has been added here.\n\n### PoC\n1. Identify a valid `flow_id` for a flow that performs a sensitive action (e.g., sending an email, writing to a database, or executing a Python script).\n2. Execute a POST request to the webhook endpoint without any `Authorization` header or API Key:\n```bash\ncurl -X POST \"http://<server-ip>:7860/api/v1/webhook/<flow_id>\" \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\"input\": \"payload\"}'\n```\n3. Verify that the flow execution is triggered and the action is performed on the server.\n\n### Impact\nThis is a **High-severity Authentication Bypass**.\n- **Remote Code Execution (RCE)**: Flows often contain components that execute arbitrary Python code. An attacker can leverage this to gain full control over the server.\n- **Denial of Service (DoS)**: Attackers can exhaust system resources by triggering heavy flows concurrently.\n- **Data Integrity**: Unauthorized execution of flows can lead to unintended modification of databases or external systems connected via the flow.\n\n### Affected versions\n`>= 1.7.0, <= 1.9.0` (the range in which `WEBHOOK_AUTH_ENABLE` existed and defaulted to `False`).\n\n### Fix\nFixed in **v1.9.1** by [PR #12845](https://github.com/langflow-ai/langflow/pull/12845) — `fix(security): default WEBHOOK_AUTH_ENABLE to True`. The setting's default changed from `False` to `True`, so webhook endpoints now require API key authentication and ownership validation by default, unless an operator explicitly opts out via `LANGFLOW_WEBHOOK_AUTH_ENABLE=false`.","categories":["Applications & CMS"],"product":"langflow","vendor":"IBM","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cf6m-vc3m-7cgm","source_modified_at":"2026-10-05T22:31:23Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"langflow"},"range":">= 1.7.0, <= 1.9.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-8505","source_modified_at":"2026-07-23T03:56:06.902Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Langflow OSS","vendor":"IBM","versions":[{"status":"affected","version":"1.0.0","lessThanOrEqual":"1.10.0","versionType":"semver"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cf6m-vc3m-7cgm","source_modified_at":"2026-10-15T14:56:16.866108219Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"langflow","purl":"pkg:pypi/langflow"},"ranges":[{"events":[{"introduced":"1.7.0"},{"fixed":"1.9.1"}],"type":"ECOSYSTEM"}],"versions":["1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.8.0rc0","1.8.0rc1","1.8.0rc2","1.8.0rc3","1.8.0rc4","1.8.0rc5","1.8.0rc6","1.8.1","1.8.2","1.8.3","1.8.3rc0","1.8.4","1.9.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cf6m-vc3m-7cgm","source_modified_at":"2026-10-05T22:31:23Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"langflow"},"version":"1.9.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cf6m-vc3m-7cgm","source_modified_at":"2026-10-15T14:56:16.866108219Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"langflow","purl":"pkg:pypi/langflow"},"version":"1.9.1"}],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00719,"percentile":0.5339,"score_date":"2026-10-23"},"published_at":"2026-07-17T19:06:00.986Z","modified_at":"2026-10-15T14:56:16.866108219Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-cf6m-vc3m-7cgm","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T22:31:23Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-8505","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-23T03:56:06.902Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-cf6m-vc3m-7cgm","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T14:56:16.866108219Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-8505","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-cf6m-vc3m-7cgm","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8505","source":"GitHub Advisory Database"},{"url":"https://github.com/langflow-ai/langflow/pull/12845","source":"GitHub Advisory Database"},{"url":"https://github.com/langflow-ai/langflow/commit/cb6f7508dda83ead9c3e4417e96e4b5bd9a260c3","source":"GitHub Advisory Database"},{"url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.1","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.ibm.com/support/pages/node/7278921","tags":["vendor-advisory","patch"]},{"url":"https://github.com/advisories/GHSA-cf6m-vc3m-7cgm","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-07-22T00:00:00+00:00"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:56:16.866108219Z","content_hash":"cdd578255f64cb672833a7cc1cb0e69c2150458c8dda7ddd59774030dd229919"}}