PT-2026-68254 · Ibm · Langflow Oss
CVE-2026-8446
·
Published
2026-08-05
·
Updated
2026-08-06
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
IBM Langflow OSS versions 1.0.0 through 1.10.3
Description
An authentication bypass exists in the Model Context Protocol (MCP) composer endpoint. This occurs when the
mcp composer enabled variable is set to true (the default setting) and projects are configured with the auth type variable set to oauth.Recommendations
Update IBM Langflow OSS to a version later than 1.10.3.
As a temporary mitigation, set the
mcp composer enabled variable to false or change the auth type configuration from oauth.Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Langflow Oss