CVE-2026-8446 Overview
CVE-2026-8446 is an authentication bypass vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw resides in the Model Context Protocol (MCP) composer endpoint. It is exploitable when mcp_composer_enabled=true (the default configuration) and when projects are configured with auth_type=oauth. An unauthenticated remote attacker can reach the affected endpoint over the network without user interaction. Successful exploitation exposes confidential project data managed by the MCP composer. The underlying weakness is classified as Missing Authentication for Critical Function [CWE-306].
Critical Impact
Unauthenticated network attackers can bypass OAuth-protected MCP composer endpoints in default IBM Langflow OSS deployments and access sensitive project data.
Affected Products
- IBM Langflow OSS 1.0.0 through 1.10.3
- Deployments with mcp_composer_enabled=true (default setting)
- Projects configured with auth_type=oauth
Discovery Timeline
- 2026-08-05 - CVE-2026-8446 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-8446
Vulnerability Analysis
The vulnerability affects the Model Context Protocol (MCP) composer endpoint in IBM Langflow OSS. Langflow is an open-source framework for building applications backed by large language models. The MCP composer endpoint is intended to be protected when projects declare OAuth as their authentication type. However, the endpoint fails to enforce authentication controls in this configuration. An attacker can send crafted requests directly to the endpoint without presenting valid OAuth credentials. The impact is limited to confidentiality according to the CVSS vector, meaning integrity and availability of the target remain intact. The default enablement of mcp_composer_enabled increases exposure across typical deployments.
Root Cause
The root cause is Missing Authentication for Critical Function [CWE-306]. The MCP composer endpoint does not validate OAuth session state or bearer tokens before processing requests. Authentication enforcement logic assumes prior middleware handling that is not applied to this specific route. Projects that opt into auth_type=oauth therefore inherit a false sense of protection.
Attack Vector
Exploitation requires network access to the Langflow instance and no privileges or user interaction. The attacker issues HTTP requests to the MCP composer endpoint on a vulnerable server. Because authentication checks are absent, the endpoint returns data intended only for authenticated users. Refer to the IBM Support Page for technical details from the vendor.
No verified public exploit code is available for this vulnerability. The mechanism can be reproduced by sending unauthenticated HTTP requests to the MCP composer route on an affected instance where mcp_composer_enabled=true and a project uses auth_type=oauth.
Detection Methods for CVE-2026-8446
Indicators of Compromise
- Unauthenticated HTTP requests to MCP composer endpoints returning 200 status codes instead of 401 or 403 responses.
- Access log entries referencing the MCP composer route without preceding OAuth token exchange traffic.
- Unexpected data egress from Langflow hosts to unfamiliar external IP addresses.
Detection Strategies
- Inspect Langflow application logs for requests to MCP composer routes that lack authentication headers.
- Correlate reverse-proxy and web application firewall logs against the Langflow OAuth authorization flow to identify skipped authentication steps.
- Alert on anomalous request volumes targeting the MCP composer endpoint from single source addresses.
Monitoring Recommendations
- Ingest Langflow access and application logs into a centralized analytics platform for continuous review.
- Baseline normal request patterns to the MCP composer endpoint and flag deviations.
- Monitor outbound network flows from Langflow servers for signs of data staging or exfiltration.
How to Mitigate CVE-2026-8446
Immediate Actions Required
- Upgrade IBM Langflow OSS to a fixed release as described on the IBM Support Page.
- Restrict network access to the Langflow MCP composer endpoint using firewall rules or reverse proxy allowlists until patching is complete.
- Audit existing projects configured with auth_type=oauth for signs of unauthorized access.
Patch Information
IBM has published guidance for CVE-2026-8446 on the IBM Support Page. Administrators running IBM Langflow OSS versions 1.0.0 through 1.10.3 should review the advisory and apply the vendor-supplied fix. Verify the running version with the deployment's package manager output before and after upgrading.
Workarounds
- Set mcp_composer_enabled=false in the Langflow configuration if the MCP composer feature is not required.
- Place the Langflow service behind an authenticating reverse proxy that enforces OAuth validation at the network edge.
- Limit inbound access to the MCP composer endpoint to trusted management networks only.
# Configuration example: disable MCP composer where not required
export MCP_COMPOSER_ENABLED=false
# Restart the Langflow service after applying the change
systemctl restart langflow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
