IBM Langflow OSS versions 1.0.0 to 1.10.3 contain an authentication bypass flaw in the Model Context Protocol (MCP) composer endpoint. When the feature mcp_composer_enabled is set to true, which is the default, and projects are configured to use OAuth authentication, the endpoint does not enforce proper credential checks. This allows an unauthenticated actor to reach the composer functionality and potentially submit or modify model context data, leading to unauthorized access to internal resources and the ability to influence model behavior. The weakness is classified as CWE‑306, indicating a missing authentication step.

IBM Langflow OSS 1.0.0 through 1.10.3 are affected. The vulnerability is present in the MCP composer endpoint that is enabled by default in these releases. If the environment variable mcp_composer_enabled remains true and OAuth authentication is used for a project, the system is vulnerable. No other versions or products are affected according to the current CNA data.

The CVSS score of 7.5 reflects a high-severity authentication bypass. The EPSS score is not available, so the current exploitation probability is unknown, but the flaw is enabled by default, increasing the likelihood that systems remain vulnerable until patching. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread, publicly known exploitation has been observed as of this analysis. Attackers could exploit the flaw remotely by sending crafted requests to the MCP composer endpoint without authenticating, provided the feature is enabled and OAuth is in use.