CISA confirmed active exploitation of CVE-2026-9198, adding it to the Known Exploited Vulnerabilities catalog on August 4, 2026.
The vulnerability lets an unauthenticated attacker chain two API endpoints to gain full remote code execution on a default Langflow deployment. IBM, which maintains Langflow, disclosed the vulnerability on July 17, 2026, and shipped a fix the same day. The company is now urging all Langflow OSS users to apply that fix immediately, given the confirmed exploitation activity.
CVE-2026-9198: How the Endpoint Chain Leads to Full RCE
Critical
9.8
Yes
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-9198 is a code injection vulnerability, tracked under CWE-94, in IBM Langflow OSS versions 1.0.0 through 1.10.0. The root cause traces to an insecure default configuration combined with unsafe use of dynamic code evaluation. The /api/v1/auto_login endpoint fails to enforce authentication and isn’t bound to loopback, so it mints SUPERUSER tokens for any network caller rather than restricting access to the local host. The /api/v1/validate/code endpoint then trusts that authenticated input and evaluates attacker-supplied Python directly through exec().
Chained together, an unauthenticated attacker can mint a superuser token from the first endpoint, then hand arbitrary Python code to the second endpoint to run with full administrative privileges. On a default Langflow deployment, that is complete remote code execution with no login, no user interaction, and no prior access required.
CVE-2026-9198: Affected Versions
| Detail | Value |
|---|---|
| Affected versions | Langflow OSS 1.0.0 – 1.10.0 |
| Disclosure date | July 17, 2026 |
| Fixed in | 1.10.1Patched same day |
| Current stable release | 1.11.2 |
Anyone running a self-hosted or containerized Langflow instance should confirm their build version against IBM’s support.
CVE-2026-9198: Why This Vulnerability Matters
As an AI workflow and agent-orchestration tool, Langflow typically holds model-provider API keys, database credentials, connector tokens, and access to whatever files or systems its flows are wired into. An attacker who achieves RCE on a Langflow host gets a path to every credential and connected system that Langflow was trusted with.
🚨 CISA KEV Confirmation: CVE-2026-9198 was added to CISA’s Known Exploited Vulnerabilities catalog on August 4, 2026. Confirmed exploitation activity means any internet-facing Langflow instance should be treated as a live target.
Public exploit code is already circulating, with reports pointing to exploit-development artifacts and staging infrastructure consistent with active testing and weaponization, separate from any confirmed victim compromise. A related campaign has already been tied to an AI-enabled autonomous hacking operation that pivoted between multiple Langflow and adjacent tooling vulnerabilities when initial attempts were blocked.
The threat actor used an AI agent to independently research alternate entry points. That combination, a low-effort exploit chain, public PoC circulation, and demonstrated attacker automation, makes any internet-facing Langflow instance a live target.
CVE-2026-9198: Mitigation Recommendations
Since this vulnerability is already being actively exploited, the priority is closing the exploit path immediately rather than treating it as a routine patch cycle item. Follow these steps to reduce exposure:
Upgrade Langflow to version 1.10.1 or later
Redeploy any containerized instances using the updated image rather than patching in place, since older container builds can silently persist the vulnerable code.
Remove Langflow from direct internet exposure
Place it behind an authenticating reverse proxy or VPN, so the vulnerable endpoints are never reachable by unauthenticated network callers in the first place.
Rotate all secrets and credentials
Rotate API keys and model-provider credentials stored in Langflow flows on any host that was internet-facing before patching, since a compromised instance may have already exposed them.
Audit affected hosts for prior exploitation
Look for unfamiliar cron entries, new SSH keys, and unexpected outbound connections.
Verify the fix took effect
Confirm /api/v1/auto_login no longer issues tokens to unauthenticated callers and is bound to loopback after upgrading.
Track exploitation activity going forward
Monitor EPSS movement and exploitation reporting for this CVE alongside routine scans of internet-facing Langflow assets, since attacker tooling is still evolving.
AppTrana WAAP Coverage for CVE-2026-9198
AppTrana blocks exploitation attempts targeting this vulnerability, giving customers running Langflow behind AppTrana protection while patching is completed. AppTrana WAAP inspects incoming requests to internet-facing applications and blocks traffic that matches known malicious patterns, including attempts to abuse authentication and code-execution endpoints.
Block exploitation of CVE-2026-9198 while your team completes the upgrade to 1.10.1+.