A critical vulnerability in Langflow could allow an unauthenticated attacker to trigger AI workflows through exposed webhook endpoints, potentially leading to remote code execution, denial of service or unauthorized actions on connected systems.
The flaw affects Langflow versions 1.7.0 through 1.9.0 and was fixed in version 1.9.1. GitHub’s security advisory rates the issue Critical with a CVSS score of 9.8.
Langflow is an open-source platform used to build AI applications and workflows by connecting models, data sources, tools and other components. It supports webhooks that allow outside applications or services to trigger a flow by sending a request to a specific endpoint.
In affected versions, webhook authentication was disabled by default. When the setting remained disabled, Langflow could process a webhook request without requiring an API key.
An attacker who knew a flow’s unique identifier, or UUID, could therefore trigger that flow without signing in or providing authentication credentials.
The request could be treated as though it came from the owner of the flow.
Why Unauthorized Flow Execution Matters
The impact depends on what the targeted workflow is configured to do.
Flows can interact with databases, external APIs, scripts, AI models and other connected services. Triggering one without authorization could therefore cause actions that would normally be limited to the flow owner or another approved service.
The advisory says the vulnerability could potentially lead to remote code execution when a flow includes components capable of running Python code. Repeatedly triggering resource-intensive flows could also cause a denial of service, while other workflows could make unintended changes to connected systems.
Remote code execution is not an automatic result of the authentication bypass itself and depends on the capabilities of the targeted flow.
Langflow addressed the issue in version 1.9.1 by changing webhook authentication from disabled to enabled by default. Administrators running versions 1.7.0 through 1.9.0 should upgrade to a newer release and verify that webhook authentication is enabled.
With authentication enabled, webhook requests require a valid API key and Langflow verifies that the authenticated user owns the flow being executed.
Langflow still allows administrators to intentionally disable webhook authentication, so installations configured with LANGFLOW_WEBHOOK_AUTH_ENABLE=false can continue accepting unauthenticated webhook requests.
The vulnerability was publicly disclosed on August 12, 2026. The advisory does not state that the flaw has been exploited in the wild.
Leave a Reply