IBM Langflow, the open-source framework for building and deploying LLM-powered agent pipelines, has landed on CISA’s Known Exploited Vulnerabilities catalog for the third time this year. CVE-2026-9198, disclosed July 17 and added to KEV on August 4, chains two separate flaws into unauthenticated remote code execution on any default Langflow install — no credentials required, no user interaction needed.

The Vulnerability

CVE-2026-9198 (CVSS 9.8, CWE-94 — Improper Control of Generation of Code) is really two bugs stacked together:

Step one — auto-login bypass (CVE-2026-9103). Langflow ships an /api/v1/auto_login endpoint intended to streamline local development by minting a SUPERUSER session token without a password prompt. The endpoint is supposed to be restricted to loopback callers, but that binding isn’t enforced — any network caller who can reach the API gets handed a superuser token, no authentication whatsoever.

Step two — unsandboxed code validation (CVE-2026-8481). Once an attacker holds that superuser token, /api/v1/validate/code will happily exec() whatever Python it’s handed as part of “validating” a custom component. There’s no sandboxing, no allowlist, no restriction on what the submitted code can import or call.

Chained together, the attack is two HTTP requests: GET /api/v1/auto_login to mint a token, then POST /api/v1/validate/code with a Python payload, using that token. The result is arbitrary code execution in the context of the Langflow server process — full compromise of the host, any credentials or API keys the service can reach, and a foothold into whatever it’s connected to (vector databases, LLM provider accounts, internal CI/CD, cloud metadata services).

Affected versions are IBM Langflow OSS 1.0.0 through 1.10.0. IBM shipped the fix the same day it disclosed the flaw — version 1.10.1 closes both the auto-login binding gap and the code-validation sandbox gap.

Active Exploitation

Multiple fully weaponized public proof-of-concept exploits for CVE-2026-9198 appeared in late July, well before most self-hosted instances patched. CISA confirmed in-the-wild exploitation and added the CVE to KEV on August 4, 2026, in the same batch as an Apache Tomcat EncryptInterceptor bypass (CVE-2026-34486) and an N-able N-central authentication bypass (CVE-2026-18577) — three unrelated but simultaneously exploited pieces of internet-facing infrastructure software, all carrying the same remediation deadline.

Given the trivial two-request exploit chain and the availability of public PoC code, mass scanning against internet-exposed Langflow instances should be assumed to be underway. Because Langflow is frequently deployed with default settings for quick prototyping — and auto-login is often left enabled in exactly those default configs — the population of vulnerable, internet-reachable instances is likely larger than for a typical enterprise-software CVE.

Not Langflow’s First Rodeo

This is the third Langflow CVE to reach KEV inside a single year: CVE-2026-33017 (an unauthenticated RCE via /api/v1/build_public_tmp/{flow_id}/flow, disclosed March, whose “fix” in 1.8.2 was later shown to still be exploitable) and CVE-2026-55255 (an IDOR letting authenticated users hijack other users’ flows and their embedded credentials, disclosed July) both preceded it. The pattern across all three is consistent: endpoints intended for convenience — auto-login, public flow builds, cross-user lookups — shipped without the authentication or sandboxing checks that would normally gate them in production. Langflow’s rapid adoption as glue for internal AI-agent tooling and CI/CD pipelines makes each of these bugs disproportionately valuable to attackers relative to a typical single-app RCE.

Who’s Affected and What to Do

Anyone running self-hosted IBM Langflow OSS 1.0.0–1.10.0, especially with default configuration and any degree of network exposure, is vulnerable to full unauthenticated takeover.

Immediate steps:

  • Upgrade to Langflow 1.10.1 or later on every instance — production, staging, and any internal CI/CD or agent-tooling deployment.
  • If you cannot patch immediately, disable auto-login entirely and firewall the Langflow management API to trusted networks only; do not expose /api/v1/auto_login or /api/v1/validate/code to the internet under any circumstance.
  • Audit logs for unauthenticated calls to /api/v1/auto_login followed by /api/v1/validate/code from the same source in a short window — that sequence is the exploit signature.
  • Treat any credentials, API keys, or database secrets reachable from a Langflow instance that was internet-exposed prior to patching as compromised, and rotate them.
  • If you’re also running an instance still on pre-1.9.1 code, remediate CVE-2026-33017 and CVE-2026-55255 in the same pass — attackers have been observed chaining Langflow’s multiple open flaws together.

References