Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

Summary

A vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False. This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE) or Denial of Service (DoS).

Details

The WEBHOOK_AUTH_ENABLE setting was introduced in v1.7.0 (#9139) with a default of False. The root cause is in the webhook authentication path, AuthService.get_webhook_user (src/backend/base/langflow/services/auth/service.py; the thin wrapper in src/backend/base/langflow/services/auth/utils.py just delegates to it):

async def get_webhook_user(self, flow_id: str, request: Request) -> UserRead:
    settings_service = self.settings
    ...
    # VULNERABILITY: If this setting is False (default in <= 1.9.0), it returns
    # the flow owner WITHOUT checking the API Key in the request.
    if not settings_service.auth_settings.WEBHOOK_AUTH_ENABLE:
        try:
            flow_owner = await get_user_by_flow_id_or_endpoint_name(flow_id)
            return flow_owner

By default (v1.7.0 through v1.9.0), Langflow treats WEBHOOK_AUTH_ENABLE as False, meaning all webhook endpoints are public. This relies exclusively on the secrecy of the flow_id (UUID), which is an insecure practice (Security by Obscurity).

A related report, GHSA-6g4m-v5q2-475v, demonstrated a concrete RCE chain through this same bypass using the PythonCodeStructuredTool component (exec() on flow-authored Python code). That report is a duplicate of this root cause and has been closed in favor of this advisory; credit for that PoC has been added here.

PoC