CVE-2026-8505: Langflow Unauthenticated Flow Execution via Webhook Authentication Bypass
Summary
CVE-2026-8505: Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass. Affects langflow versions >= 1.7.0, < 1.9.1. Fixed in 1.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Langflow is an open-source framework that allows users to create and manage workflows involving various components, including executing Python code. It provides a user-friendly interface for building complex flows that can interact with external systems. However, a critical vulnerability has been identified that affects its webhook authentication mechanism, potentially exposing sensitive operations to unauthorized users.
Vulnerability Detail
The vulnerability arises from a flaw in Langflow's webhook authentication logic, where the configuration setting 'WEBHOOK_AUTH_ENABLE' defaults to 'False'. This allows unauthenticated users to execute any flow by simply knowing its UUID, bypassing API key validation. The root cause is located in the 'get_webhook_user' function, which fails to verify the API key when the authentication setting is disabled. This can lead to severe consequences, including Remote Code Execution (RCE) and Denial of Service (DoS), as attackers can exploit the flaw to execute arbitrary code or exhaust system resources.
How To Fix
Latest published version: 1.14.0.dev2 as of 22 Oct 2026
pip install --upgrade "langflow==1.14.0.dev2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.1
This is the first release that contains the fix.
pip install --upgrade "langflow==1.9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if you cannot update to the patched version, you can manually set 'WEBHOOK_AUTH_ENABLE' to 'True' in your configuration file to enforce API key validation. However, this is not a substitute for updating the package.
Conclusion
The vulnerability CVE-2026-8505 in Langflow poses a significant risk due to its authentication bypass flaw, allowing unauthorized flow execution. It is crucial to update to version 1.9.1 or later to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for langflow →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Langflow versions from 1.7.0 to 1.9.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized execution of flows, Remote Code Execution (RCE), Denial of Service (DoS), and data integrity issues.
Yes, you can temporarily set 'WEBHOOK_AUTH_ENABLE' to 'True' in your configuration to enforce API key validation until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
