AI Threat Alert
CVE-2026-8446: Langflow: OAuth auth bypass on MCP composer endpoint
HIGHIBM's Langflow, a widely deployed low-code framework for building LLM and agent pipelines, ships with an authentication bypass (CWE-306) in its Model Context Protocol composer endpoint: when the default mcp_composer_enabled setting is on and a project uses auth_type=oauth, an unauthenticated network attacker with no privileges and no user interaction can reach the composer and read data that should require a valid session. The CVSS 7.5 score reflects confidentiality-only impact — no code execution, no data tampering — but Langflow's MCP composer typically brokers connections to internal tools, connectors, and RAG data sources, so exposure can mean leaked tool configurations, connection details, or proprietary agent context rather than a mere information nuisance. There's no known public exploit or Nuclei template, it isn't in CISA KEV, and CISA's own SSVC call is TRACK rather than Act, but the EPSS score still places it in the top 79th percentile of CVEs for likely exploitation, and the combination of network vector, low complexity, and zero privileges required makes it trivial to weaponize once an internet-facing instance is found. Inventory any Langflow 1.0.0–1.10.3 deployment with the MCP composer enabled and OAuth projects, patch to IBM's fixed release, or in the interim disable mcp_composer_enabled or restrict the composer endpoint to trusted networks, and watch access logs on that path for unauthenticated requests as a detection signal.
What is the risk?
Technically trivial to exploit — network-reachable, low attack complexity, no privileges, no user interaction — which normally pushes urgency high. What tempers that is the impact ceiling: confidentiality only (C:H/I:N/A:N), no code execution or system takeover, no public exploit code or scanner template observed, and CISA's SSVC assessment lands at TRACK rather than Act. EPSS in absolute terms is low (0.28%) but relatively high (top 79th percentile), signaling researcher/attacker interest is plausible even without confirmed in-the-wild activity yet. Because mcp_composer_enabled defaults to true, the vulnerable configuration is the out-of-box state for any project that also enables OAuth — meaning exposure is driven by adoption of a common, not niche, configuration, which raises the realistic attack surface across Langflow's install base.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade Langflow past 1.10.3 to the IBM-patched release referenced in the vendor advisory (https://www.ibm.com/support/pages/node/7282147). Until patched: set mcp_composer_enabled=false on any internet-facing instance, or avoid pairing auth_type=oauth with MCP composer exposure; place the composer endpoint behind network-level access controls (VPN, allowlist, reverse-proxy auth) rather than relying on Langflow's own OAuth gate. Detection: monitor web/access logs for unauthenticated or anomalous requests to the MCP composer path, and audit which Langflow projects currently have both mcp_composer_enabled and oauth active to prioritize remediation.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-8446?
IBM's Langflow, a widely deployed low-code framework for building LLM and agent pipelines, ships with an authentication bypass (CWE-306) in its Model Context Protocol composer endpoint: when the default mcp_composer_enabled setting is on and a project uses auth_type=oauth, an unauthenticated network attacker with no privileges and no user interaction can reach the composer and read data that should require a valid session. The CVSS 7.5 score reflects confidentiality-only impact — no code execution, no data tampering — but Langflow's MCP composer typically brokers connections to internal tools, connectors, and RAG data sources, so exposure can mean leaked tool configurations, connection details, or proprietary agent context rather than a mere information nuisance. There's no known public exploit or Nuclei template, it isn't in CISA KEV, and CISA's own SSVC call is TRACK rather than Act, but the EPSS score still places it in the top 79th percentile of CVEs for likely exploitation, and the combination of network vector, low complexity, and zero privileges required makes it trivial to weaponize once an internet-facing instance is found. Inventory any Langflow 1.0.0–1.10.3 deployment with the MCP composer enabled and OAuth projects, patch to IBM's fixed release, or in the interim disable mcp_composer_enabled or restrict the composer endpoint to trusted networks, and watch access logs on that path for unauthenticated requests as a detection signal.
Is CVE-2026-8446 actively exploited?
No confirmed active exploitation of CVE-2026-8446 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-8446?
Upgrade Langflow past 1.10.3 to the IBM-patched release referenced in the vendor advisory (https://www.ibm.com/support/pages/node/7282147). Until patched: set mcp_composer_enabled=false on any internet-facing instance, or avoid pairing auth_type=oauth with MCP composer exposure; place the composer endpoint behind network-level access controls (VPN, allowlist, reverse-proxy auth) rather than relying on Langflow's own OAuth gate. Detection: monitor web/access logs for unauthenticated or anomalous requests to the MCP composer path, and audit which Langflow projects currently have both mcp_composer_enabled and oauth active to prioritize remediation.
What systems are affected by CVE-2026-8446?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP-based tool orchestration, RAG pipelines, low-code AI pipelines.
What is the CVSS score for CVE-2026-8446?
CVE-2026-8446 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.28%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049 Exploit Public-Facing Application AML.T0084 Discover AI Agent Configuration Compliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .
Exploitation Scenario
An attacker scans the internet (e.g., via Shodan/fingerprinting of Langflow's default UI/API signatures) for exposed Langflow instances. Finding one with MCP composer enabled and an OAuth-configured project, the attacker sends a direct, unauthenticated HTTP request to the composer endpoint instead of going through the normal login flow. Because of the CWE-306 flaw, the request succeeds and returns composer data — connected MCP server/tool configurations and related metadata — without ever presenting valid OAuth credentials. The attacker then uses that leaked configuration information to map the victim's agent tooling and data connections for targeted follow-on attacks against those downstream systems.
Weaknesses (CWE)
CWE-306 Missing Authentication for Critical Function
Primary
CWE-306 Missing Authentication for Critical Function CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- [Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N References
Timeline
Related Vulnerabilities
CVE-2026-10561 10.0 Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflow CVE-2026-10134 10.0 Langflow: unauthenticated RCE via tool_code injection
Same package: langflow CVE-2026-33309 9.9 langflow: Path Traversal enables file access
Same package: langflow CVE-2026-55255 9.9 Langflow: IDOR allows cross-user flow execution
Same package: langflow CVE-2026-7873 9.9 Langflow: authenticated RCE enables credential theft
Same package: langflow