CVE-2026-8446

Langflow is affected by security vulnerabilities in Model Context Protocol features PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.10.3

CWE

CWE-306

References

https://www.ibm.com/support/pages/node/7282147

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.