Critical Webhook Authentication Bypass in Langflow Package
Summary
GHSA-9cc5-j3qq-69gv: Duplicate Advisory: Unauthenticated Flow Execution via Webhook Authentication Bypass. Affects langflow versions >= 1.7.0, <= 1.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source framework designed for building and managing workflows in Python. It allows users to create, execute, and manage various flows through a user-friendly interface. However, versions 1.0.0 to 1.10.0 of Langflow contain a critical vulnerability that compromises the security of its webhook authentication mechanism, potentially exposing sensitive workflows to unauthorized execution.
Vulnerability Detail
The vulnerability arises from an improper implementation of webhook authentication logic in Langflow. When the configuration setting WEBHOOK_AUTH_ENABLE is set to False (the default), the system fails to validate API keys correctly. This oversight allows unauthenticated users to trigger the execution of any flow by knowing its UUID, which could lead to severe consequences, including Remote Code Execution (RCE). Attackers can exploit this flaw to execute arbitrary code within the application, posing significant risks to data integrity and system security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can set the WEBHOOK_AUTH_ENABLE configuration to True in their settings to prevent unauthorized access until the package is updated. This can be done by modifying the configuration file or environment variable as follows: WEBHOOK_AUTH_ENABLE=True.
Conclusion
The Langflow package has a critical vulnerability that allows unauthenticated users to execute workflows due to improper webhook authentication. Users are advised to update to the latest version to mitigate risks. Additionally, temporary workarounds are available to enhance security until the update is applied.
See every vulnerability recorded for langflow →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Langflow versions 1.0.0 through 1.10.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized execution of workflows, potentially resulting in Remote Code Execution (RCE) and compromising sensitive data.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities in your software using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
