CISA KEV Alert: IBM Langflow CVE Enables Unauthenticated RCE on AI Workflow Platform

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. This critical flaw in IBM Langflow OSS allows unauthenticated attackers to execute remote code with superuser privileges. Federal agencies face a three-day patch deadline, and security teams worldwide should treat any internet-facing Langflow instance as an active target.

What Happened: Langflow RCE Exploitation Confirmed

CVE-2026-9198 is a code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. It carries a CVSS score of 9.8, the highest critical rating. IBM disclosed the flaw on July 17, 2026, and shipped a same-day fix in version 1.10.1.

Despite the quick vendor response, threat actors moved fast. KEVIntel telemetry has recorded 654 exploitation attempts from 244 unique attacker IPs across 41 countries starting July 6, 2026. Furthermore, multiple fully functional proof-of-concept exploits emerged in late July, lowering the barrier for entry.

CISA confirmed active exploitation on August 4, 2026, adding the vulnerability to its KEV catalog. The agency ordered federal civilian agencies to apply mitigations by August 7, 2026. While the directive applies only to government agencies, CISA encourages all organizations to prioritize remediation.

Technical Details of the Langflow Vulnerability

The attack relies on chaining two API endpoints on a default Langflow deployment. Neither endpoint requires authentication, and both are reachable over the network in standard configurations.

Attack Chain

1. Token minting: The attacker sends a request to /api/v1/auto_login. This endpoint was designed to streamline local development by issuing a SUPERUSER JWT automatically. In default deployments, it is not restricted to localhost or gated behind any configuration flag. Any network caller receives a fully privileged token.
2. Code execution: With the superuser token, the attacker POSTs a JSON payload containing Python source code to /api/v1/validate/code. This endpoint evaluates submitted code via Python’s built-in exec() function to validate component logic. Because exec() runs the supplied code in the Langflow server process, the attacker achieves arbitrary code execution under the service account.

Root Cause

The vulnerability stems from two insecure design choices:

• Insecure default configuration: The auto-login endpoint is exposed to all network interfaces without origin checks.
• Unsafe code evaluation: The validation endpoint uses exec() on attacker-controlled input after only a token check.

This combination is classified under CWE-94: Improper Control of Generation of Code. Exploitation requires only network reachability to the Langflow HTTP API. No valid account, user interaction, or prior access is needed.

Business and Operational Impact

Langflow is an open-source framework for building LLM-driven agent workflows. Consequently, compromised Langflow hosts often contain high-value secrets and broad network access. The business impact of a successful exploit is severe.

• Credential theft: Langflow stores API keys for model providers, database connectors, and cloud services.
• Data exposure: Attackers gain access to workflow inputs, outputs, and connected file systems.
• Lateral movement: The Langflow server typically has network access to downstream systems, making it an ideal pivot point.
• Supply-chain risk: Altered workflows could inject malicious outputs into production pipelines.
• AI infrastructure abuse: Attackers can leverage compromised instances for cryptomining, model inference abuse, or further AI-targeted attacks.

A related campaign tied to a Chinese-speaking threat actor has already used AI-enabled autonomous hacking tools to pivot between multiple AI platform vulnerabilities when initial exploitation attempts failed.

Mitigation and Recommendations

IBM released patched versions on July 17, 2026. Organizations running Langflow OSS must take immediate action.

Immediate Actions for Defenders

1. Upgrade immediately. Update to Langflow OSS 1.10.1 or later. The current stable release is 1.11.2.
2. Validate exposure. Confirm whether any Langflow instances are reachable from untrusted networks. Default deployments are especially at risk.
3. Review access logs. Look for requests to /api/v1/auto_login and /api/v1/validate/code from unexpected source addresses.
4. Rotate secrets. If compromise is suspected, rotate all API keys, database credentials, and connector tokens stored in Langflow.
5. Segment network access. Restrict Langflow API endpoints to internal or VPN-only networks until patches are confirmed.

Detection Guidance

Security teams should monitor for the following indicators:

• Unexpected HTTP requests to /api/v1/auto_login from external IPs.
• POST requests to /api/v1/validate/code containing Python keywords or shell commands.
• New processes spawned by the Langflow service account.
• Outbound network connections from Langflow hosts to unexpected destinations.

Bottom line: CVE-2026-9198 is a fully unauthenticated critical RCE in a widely used AI framework. With public exploit code circulating and hundreds of confirmed attack attempts, patching is not optional. If you run Langflow OSS 1.10.0 or earlier, assume your instance is a target and upgrade today.

Incident Summary

CVE ID:	CVE-2026-9198
Affected Systems:	IBM Langflow OSS 1.0.0 – 1.10.0
Severity:	Critical (CVSS 9.8)
Disclosure Date:	July 17, 2026
Patch Status:	Fixed in version 1.10.1; current stable is 1.11.2
CISA KEV Added:	August 4, 2026
Exploitation Evidence:	654 attempts from 244 IPs across 41 countries
Attack Vector:	Network (unauthenticated)

References

1. CISA, “CISA Adds Three Known Exploited Vulnerabilities to Catalog,” August 4, 2026, https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog, accessed August 8, 2026.
2. IBM, “Security Bulletin: Langflow OSS Arbitrary Code Execution,” July 17, 2026, https://www.ibm.com/support/pages/node/7278927, accessed August 8, 2026.
3. The Hacker News, “CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited,” August 5, 2026, https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html, accessed August 8, 2026.
4. BleepingComputer, “CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws,” August 5, 2026, https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-langflow-n-central-apache-tomcat-flaws/, accessed August 8, 2026.
5. KEVIntel, “CVE-2026-9198: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation,” accessed August 8, 2026, https://kevintel.com/CVE-2026-9198.
6. SentinelOne, “CVE-2026-9198: Langflow RCE Vulnerability,” accessed August 8, 2026, https://www.sentinelone.com/vulnerability-database/cve-2026-9198/.