Executive brief
IBM Langflow OSS, a tool used for building and deploying AI workflows, contains a critical security flaw that allows anyone on the network to execute workflows without a password. An attacker could use this to access sensitive project resources or run unauthorized operations, potentially leading to data theft or complete system compromise. Organizations using affected versions should upgrade immediately to prevent unauthorized access to their AI infrastructure.
Technical details
IBM Langflow OSS (versions 1.0.0 through 1.8.4) contains an improper authentication vulnerability (CWE-287) in its webhook and Streamable MCP transport endpoints. The root cause is a failure to enforce authorization checks by default; specifically, the 'WEBHOOK_AUTH_ENABLE' configuration defaults to False, and the 'get_user_by_flow_id_or_endpoint_name()' function trusts callers unconditionally. A remote, unauthenticated attacker can send a crafted POST request to the '/api/v1/webhook/{flow_id}' endpoint to execute arbitrary flows and inject data into Webhook components. This allows for full control over component inputs and unauthorized execution of MCP operations. The vulnerability is resolved in Langflow OSS version 1.9.1.
Affected products
- IBM Langflow OSS 1.0.0-1.8.4
Timeline
- 2026-06-21: advisory: Initial IBM publication
- 2026-06-22: disclosed: NVD publication