{"data":{"id":"d35683bc-4ed4-4e2e-9a27-8b92dea12002","title":"CVE-2026-8505: IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows…","summary":"IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a flaw in the webhook authentication logic that skips API key validation when WEBHOOK_AUTH_ENABLE is set to False, which is the default. A remote attacker who knows a flow's UUID can execute that flow as if they were its owner, potentially leading to Remote Code Execution (RCE). The NVD assessment has not yet been provided.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8505","publishedAt":"2026-07-17T20:17:31.417Z","cveId":"CVE-2026-8505","cweIds":null,"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@>= 1.7.0, <= 1.9.0 (fixed: 1.9.1)"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["IBM Langflow OSS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"IBM Langflow OSS unauthenticated flow execution through webhook authentication","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00945,"epssCheckedAt":"2026-11-12T18:09:37.668Z","kevDateAdded":null,"advisoryAliases":["GHSA-cf6m-vc3m-7cgm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:24.868Z","patchAvailable":true,"disclosureDate":"2026-07-17T20:17:31.417Z","fixReleasedAt":"2026-04-24T00:34:19.524Z","daysToFix":-84,"fixCheckedAt":"2026-10-29T21:33:00.543Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.9.1","matchedVersion":"1.9.1","fixReleasedAt":"2026-04-24T00:34:19.524Z","daysToFix":-84,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:33:00.389Z"}]}}