CVE-2026-8505: IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthentica

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a vulnerability where webhook authentication can be bypassed when a configuration setting is disabled (which is the default), allowing attackers who know a flow's identifier to execute it and potentially run arbitrary code (RCE, or remote code execution). The system incorrectly skips checking API keys (credentials that verify a user's identity) when the WEBHOOK_AUTH_ENABLE setting is turned off.