Duplicate Advisory: Unauthenticated Flow Execution via Webhook Authentication Bypass
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cf6m-vc3m-7cgm. This link is maintained to preserve external references. ## Original Description IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE).
GHSA-9cc5-j3qq-69gv
Primary source · Revision 1 · Withdrawn
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-9cc5-j3qq-69gv
langflow
Source reference: /affected/0/package/name
- Affected versions
- 1.7.0
Source reference:
/affected/0/versions1.7.1Source reference:
/affected/0/versions1.7.2Source reference:
/affected/0/versions1.7.3Source reference:
/affected/0/versions1.8.0Source reference:
/affected/0/versions1.8.0rc0Source reference:
/affected/0/versions1.8.0rc1Source reference:
/affected/0/versions1.8.0rc2Source reference:
/affected/0/versions1.8.0rc3Source reference:
/affected/0/versions1.8.0rc4Source reference:
/affected/0/versions1.8.0rc5Source reference:
/affected/0/versions1.8.0rc6Source reference:
/affected/0/versions1.8.1Source reference:
/affected/0/versions1.8.2Source reference:
/affected/0/versions1.8.3Source reference:
/affected/0/versions1.8.3rc0Source reference:
/affected/0/versions1.8.4Source reference:
/affected/0/versions1.9.0Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.7.0"
},
{
"last_affected": "1.9.0"
}
]
}
],
"package": {
"name": "langflow",
"purl": "pkg:pypi/langflow",
"ecosystem": "PyPI"
},
"versions": [
"1.7.0",
"1.7.1",
"1.7.2",
"1.7.3",
"1.8.0",
"1.8.0rc0",
"1.8.0rc1",
"1.8.0rc2",
"1.8.0rc3",
"1.8.0rc4",
"1.8.0rc5",
"1.8.0rc6",
"1.8.1",
"1.8.2",
"1.8.3",
"1.8.3rc0",
"1.8.4",
"1.9.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9cc5-j3qq-69gv/GHSA-9cc5-j3qq-69gv.json"
}
}
]Publisher severity
critical
Source reference: /database_specific/severity
- Event
- #85829 · Revision 1
- Added to Heist Feed
- Publisher date