{"action":"Upgrade langflow to 1.9.1 or later.","affected":[{"fixed":"1.9.1","introduced":"1.7.0"}],"component":"langflow","cve_ids":["CVE-2026-8505"],"ecosystem":"PyPI","epss":0.0087,"exploited":false,"fixed_versions":["1.9.1"],"ghsa_id":"GHSA-cf6m-vc3m-7cgm","id":"tcs_01M5KHARP1EYV46TAJ4JX7E2C6","modified_at":"2026-10-15T14:45:12.948594146Z","published_at":"2026-10-15T10:22:44.220122Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4233","https://github.com/langflow-ai/langflow/security/advisories/GHSA-cf6m-vc3m-7cgm","https://nvd.nist.gov/vuln/detail/CVE-2026-8505","https://github.com/langflow-ai/langflow/pull/12845","https://github.com/langflow-ai/langflow/commit/cb6f7508dda83ead9c3e4417e96e4b5bd9a260c3","https://github.com/langflow-ai/langflow","https://github.com/langflow-ai/langflow/releases/tag/v1.9.1","https://www.ibm.com/support/pages/node/7278921","https://pypi.org/project/langflow","https://github.com/advisories/GHSA-cf6m-vc3m-7cgm"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-4233","url":"https://osv.dev/vulnerability/PYSEC-2026-4233"}],"summary":"Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass"}