CVE-2026-8446 — Langflow is affected by security vulnerabilities in Model Context Protocol features
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (defaul…
Published: 2026-08-05 · CVSS: 7.5 · CVSS 3.1
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7