CVE-2026-8505 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability arises because the system bypasses API key validation if the WEBHOOK_AUTH_ENABLE setting is disabled (False), which is the default configuration. This flaw allows unauthenticated remote attackers who know a flow's UUID to execute that flow with the privileges of the owner, potentially resulting in remote code execution. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No official patch or remediation guidance is provided in the available data.

An attacker can remotely execute arbitrary flows without authentication by exploiting the webhook authentication bypass. This can lead to remote code execution with the privileges of the flow owner, compromising confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider enabling the WEBHOOK_AUTH_ENABLE configuration to True to enforce API key validation and restrict unauthorized flow execution.