IBM Langflow OSS Authentication Bypass Vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a vulnerability related to authentication bypass. This vulnerability arises when the MCP Composer endpoint is set to mcpcomposerEnabled=true default value and the project...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-8446

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

CVE-2026-8446

Langflow OSS versions 1.0.0–1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects use auth_type=oauth. The issue, tracked under CVE-2026-8446, enables bypassing authentication for the MCP c...

EUVD-2026-53465

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol MCP composer endpoint when mcpcomposerenabled=true default and projects are configured with authtype=oauth...

PT-2026-68254

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authentication bypass exists in the Model Context Protocol MCP composer endpoint. This occurs when the mcp composer enabled variable is set to true the default setting and projects...