Verified

ghsa:GHSA-9CC5-J3QQ-69GV: langflow >= 1.7.0, <= 1.9.0

Duplicate Advisory: Unauthenticated Flow Execution via Webhook Authentication Bypass. Affected range: >= 1.7.0, <= 1.9.0.

Affected technology

langflow · >= 1.7.0, <= 1.9.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated users can trigger the execution of any flow. Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.

Published 12-Oct-2026 10:15 UTC

Product: langflow
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-9cc5-j3qq-69gv.html