IBM Langflow OSS 1.0.0 through 1.8.4 contains a flaw in the Streamable MCP transport endpoint that fails to enforce proper authentication. An attacker can send requests to the webhook endpoint without valid credentials, resulting in unauthorized execution of MCP project flows and access to protected data. The vulnerability enables remote actors to perform privileged operations, potentially compromising confidentiality, integrity, and availability of the affected models and data.

All installations of IBM Langflow OSS from version 1.0.0 up to and including 1.8.4 are affected. These versions provide the Streamable MCP transport endpoint used for executing workflow flows via a public webhook interface.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. No EPSS score is publicly available, but the lack of authentication requirements implies a high likelihood of exploitation in a suitable environment. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, yet the potential impact warrants urgent attention. An attacker can trigger exploitation simply by sending crafted requests to the exposed webhook endpoint from any network location, without prior compromise of the target system.