AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-8446

IBM Langflow OSS: authentication bypass

IBM

CVE-2026-8446 · Published Aug 5, 2026 · updated Aug 6, 2026

High7.5
No fix yet
IBM advisory

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .

Affected versions

PackageAffectedFixed in
Langflow OSS
Product
>= 1.0.0, <= 1.10.3No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-306

More IBM advisories

All IBM
High 7.4Aug 5IBM Langflow OSS: weak cryptographyCVE-2026-9205no fix yetHigh 8.1Aug 5IBM Langflow OSS: code injectionCVE-2026-9196no fix yetHigh 8.8Aug 5IBM Langflow OSS: code executionCVE-2026-9201no fix yetHigh 7.1Aug 5IBM Langflow OSS: information disclosureCVE-2026-9130no fix yetHigh 8.8Aug 5IBM Langflow OSS: code injectionCVE-2026-8478no fix yetHigh 7.4Aug 5IBM Langflow OSS: broken cryptographyCVE-2026-8470no fix yet