CVE-2026-8505: Langflow Webhook Authentication RCE Flaw

CVE-2026-8505 Overview

CVE-2026-8505 is an authentication bypass vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw resides in Langflow's webhook authentication logic and allows unauthenticated remote attackers to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False, which is the default setting. An attacker who knows a flow's UUID can execute it as the flow owner, potentially achieving Remote Code Execution (RCE). The vulnerability is classified under [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers with knowledge of a flow UUID can execute arbitrary flows on default Langflow deployments, enabling Remote Code Execution against the host system.

Affected Products

Langflow OSS versions 1.0.0 through 1.10.0
Deployments on Linux, macOS, and Microsoft Windows hosts
Default installations where WEBHOOK_AUTH_ENABLE=False

Discovery Timeline

2026-07-17 - CVE-2026-8505 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-8505

Vulnerability Analysis

Langflow is an open-source framework for building agentic and retrieval-augmented generation workflows. Flows are exposed through webhook endpoints that accept POST requests to trigger execution. The webhook handler consults the WEBHOOK_AUTH_ENABLE environment variable to determine whether to validate the caller's API key. When this variable is set to False, the handler skips API key verification entirely and treats the request as authorized. Because False is the shipped default, any exposed Langflow instance is vulnerable out of the box.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The webhook route conflates the toggle for enabling authentication with the enforcement of authentication itself. Instead of failing closed when authentication is disabled, the endpoint executes the requested flow as if the caller owned it. The design allows attackers to execute privileged flow logic without any credential.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker enumerates or obtains a flow UUID, then submits a POST request to the webhook endpoint corresponding to that flow. Flow UUIDs may be leaked through logs, browser history, referrers, shared notebooks, or brute-force enumeration. Once the flow executes, any component within it that runs code, shell commands, or arbitrary Python (common in Langflow custom components) provides a path to Remote Code Execution on the underlying host.

No public exploit code is available for CVE-2026-8505. Technical details are documented in the IBM Support Page.

Detection Methods for CVE-2026-8505

Indicators of Compromise

Unexpected POST requests to /api/v1/webhook/<uuid> endpoints from external or unknown source IPs
Flow executions in Langflow logs that lack an associated authenticated user session or API key identifier
Child processes spawned by the Langflow service (python, sh, bash, powershell.exe) tied to unsolicited webhook invocations
Outbound network connections from the Langflow host to attacker-controlled infrastructure following webhook activity

Detection Strategies

Audit the runtime value of WEBHOOK_AUTH_ENABLE across all Langflow deployments and flag any set to False
Correlate webhook invocation logs with API key or session identifiers, alerting when the identifier is empty
Baseline normal flow execution frequency per UUID and alert on anomalous spikes or invocations from new IP ranges

Monitoring Recommendations

Forward Langflow application and access logs to a centralized SIEM for retention and correlation
Monitor process ancestry from the Langflow service account to identify unexpected interpreter or shell execution
Track egress traffic from the Langflow host and alert on connections to non-approved destinations

How to Mitigate CVE-2026-8505

Immediate Actions Required

Set WEBHOOK_AUTH_ENABLE=True on every Langflow instance and restart the service to enforce API key validation
Restrict network exposure of Langflow to trusted networks or place it behind an authenticating reverse proxy
Rotate any flow UUIDs and API keys that may have been exposed prior to enabling authentication
Review Langflow execution logs for unauthorized webhook invocations since deployment

Patch Information

Refer to the IBM Support Page for the fixed version and remediation guidance. Upgrade Langflow OSS beyond the affected range of 1.0.0 through 1.10.0 to obtain the corrected webhook authentication logic.

Workarounds

Enforce WEBHOOK_AUTH_ENABLE=True as an environment variable at container or systemd unit level so it cannot be overridden
Terminate all inbound requests at a reverse proxy that requires mutual TLS or an authenticated header before reaching Langflow
Block direct internet access to Langflow webhook paths using network ACLs or web application firewall rules

bash

# Configuration example: enforce webhook authentication on Langflow
export WEBHOOK_AUTH_ENABLE=True
export LANGFLOW_AUTO_LOGIN=False
export LANGFLOW_SUPERUSER=admin
export LANGFLOW_SUPERUSER_PASSWORD='<strong-password>'

# Restart the service to apply
systemctl restart langflow