Tools AI Risk Radar ai-incident-0166
Incident record
Langflow fixes unauthenticated execution through webhook settings
- Severity
- Critical
- Status
- Patched
- Type
- Infra Vuln
- Target
- langflow
- Actor
- researcher
- CVE
- CVE-2026-8505
What happened
With webhook authentication disabled, a network caller who knew a flow’s identifier could run it as its owner. The impact depended on the operations that flow was configured to perform.
langflow: affected >= 1.7.0, <= 1.9.0; fixed in 1.9.1. The date shown is the maintainer’s original disclosure date. Its advisory assigns 9.8 under CVSS 3.1.
Sources
- Primary disclosuregithub.com/langflow-ai/langflow/security/advisories/GHSA-cf6…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026