CVE-2026-8505

9.8 Critique

Publiée le 17/07/2026 à 22:17 · Modifiée le 23/07/2026 à 07:16 · Modifiée · Source : psirt@us.ibm.com

Description

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE).

Traduire en français

Produits concernés

IBM Langflow OSS
Langflow langflow

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	psirt@us.ibm.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-306

Références

https://www.ibm.com/support/pages/node/7278921 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories