CVE-2026-8446

Langflow OSS versions 1.0.0–1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects use auth_type=oauth. The issue, tracked under CVE-2026-8446, enables bypassing authentication for the MCP c...