Summary
CVE-2026-8446 is an authentication bypass vulnerability (CWE-306, Missing Authentication for Critical Function) in IBM Langflow OSS. It affects versions 1.0.0 through 1.10.3 and carries a HIGH severity rating (CVSS 7.5). A remote, unauthenticated attacker can access the Model Context Protocol (MCP) composer endpoint, leading to disclosure of sensitive information.
Technical details
- Root cause: The authentication mechanism fails to validate requests to the MCP composer endpoint under a specific configuration.
- Trigger conditions: The endpoint is exposed when
mcp_composer_enabled=true(the default) and projects are configured withauth_type=oauth. - Attack vector: Network (AV:N); low attack complexity, no privileges, and no user interaction required.
- Impact: High confidentiality impact — an unauthenticated attacker can reach the MCP composer endpoint without proper credential verification, potentially accessing sensitive data. No integrity or availability impact.
Affected software
- IBM Langflow OSS versions 1.0.0 through 1.10.3.
Severity
- CVSS v3.1 base score: 7.5 (HIGH)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Upgrade to Langflow 1.11.0 or later.
- If no patch can be applied: Where feasible, disable the MCP composer (
mcp_composer_enabled=false) and review the use ofauth_type=oauthfor affected projects. Restrict network access to the Langflow instance so the MCP composer endpoint is not reachable from untrusted networks.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
<title>Langflow</title>,./assets/index-….js

