CVE-2026-9198
published 2026-07-17CVE-2026-9198: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-07
Exploited in the wild
EPSS
28.66%
98.1th percentile
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | langflow_oss | 1.0.0 – 1.10.0 | — |
| langflow | langflow | >= 1.0.0 < 1.10.1 | 1.10.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Langflow OSS up to 1.10.0 Code Execution exec os command injection (EUVD-2026-45236 / Nessus ID 333371)
vuldb·2026-08-08·CVSS 9.8
CVE-2026-9198 [CRITICAL] IBM Langflow OSS up to 1.10.0 Code Execution exec os command injection (EUVD-2026-45236 / Nessus ID 333371)
A vulnerability, which was classified as critical, has been found in IBM Langflow OSS up to 1.10.0. The affected element is the function exec of the component Code Execution Handler. This manipulation causes os command injection.
This vulnerability is handled as CVE-2026-9198. The attack can be initiated remotely. Additionally, an exploit exists.
GHSA
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exe
ghsa_unreviewed·2026-07-17
CVE-2026-9198 [CRITICAL] CWE-94 IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exe
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
VulnCheck
IBM Langflow Code Injection Vulnerability
vulncheck·2026·CVSS 9.8
CVE-2026-9198 [CRITICAL] CWE-94 IBM Langflow Code Injection Vulnerability
IBM Langflow Code Injection Vulnerability
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Affected: IBM Langflow
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Exploitation References: https://kevintel.com/CVE-2026-9198; https:
CISA
IBM Langflow Code Injection Vulnerability
cisa·2026-08-04·CVSS 9.8
CVE-2026-9198 [CRITICAL] CWE-94 IBM Langflow Code Injection Vulnerability
Vulnerability: IBM Langflow Code Injection Vulnerability
Affected: IBM Langflow
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://www.ibm.com/support/pages/node/7278927
No detection rules found.
Exploit-DB
Langflow 1.10.0 - RCE
exploitdb·2026-09-02·CVSS 9.8
CVE-2026-9198 [CRITICAL] Langflow 1.10.0 - RCE
Langflow 1.10.0 - RCE
---
# Exploit Title: Langflow 1.10.0 - RCE
# Exploit Author: Richard Howe
# Vendor Homepage: https://www.langflow.org/
# Software Link: https://www.langflow.org/desktop
# Version: str:
endpoint = '/api/v1/auto_login'
headers = {
'Content-Type': 'application/json',
}
try:
resp = get(base_url + endpoint)
except Exception as e:
raise RuntimeError(f"Error querying API.\n{str(e)}")
if resp.status_code == 200:
resp_json = resp.json()
return resp_json['access_token']
else:
raise RuntimeError(f"API returned with status code: {resp.status_code}")
def stage2(base_url:str, token: str, cmd: str):
endpoint = '/api/v1/validate/code'
headers = {'Authorization': f'Bearer {token}'}
data = {"code":"\ndef exploit(\n _=( lambda r: (_ for _ in ()).throw(Exception(f\"{r.stdout}{r.std
Metasploit
Langflow AI auto_login RCE
metasploit
CVE-2026-9198 Langflow AI auto_login RCE
Langflow AI auto_login RCE
Langflow versions 1.10.0 and below are susceptible to unauthenticated remote code execution. By chaining /api/v1/auto_login with /api/v1/validate/code, a remote unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Nuclei
IBM Langflow - Remote Code Execution
nuclei·CVSS 9.8
CVE-2026-9198 [CRITICAL] IBM Langflow - Remote Code Execution
IBM Langflow - Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/auto_login and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
Template:
id: CVE-2026-9198
info:
name: IBM Langflow - Remote Code Execution
author: YesWeHack
severity: critical
description: |
IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/auto_login and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
impact: |
Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.
remediation: |
Update to
Hackernews
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
blogs_hackernews·2026-10-15·CVSS 9.9
CVE-2026-105740 [CRITICAL] Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.
The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of authenticated remote code execution impacting versions prior to 1.9.0.
"Any authenticated Langflow user can achieve Remote Code Execution (RCE) on
Recorded Future
August 2026 CVE Landscape
blogs_recorded_future·2026-09-08·CVSS 8.8
CVE-2025-62593 [HIGH] August 2026 CVE Landscape
## August 2026 CVE Landscape
In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation , 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month. 31 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 32 were reported in open sources and validated by Insikt Group, seven were sourced through security vendor telemetry, and three were exclusively surfaced through honeypot data.
The 73 vulnerabilities in this blog affected products from 45 vendors, with Microsoft accounting for approximately 11% of the vulnerabilities. The remaining exposure spanned remote monitoring and managemen
Rapid7
Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!
blogs_rapid7·2026-08-28·CVSS 7.2
CVE-2026-59774 [HIGH] Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!
This release has something for everyone: scanner modules, payloads, and exploits. This release’s scanners cover Drupal, PanOS, WordPress, and SCADA; this release’s exploits cover Tenable, Flowise, CheckPoint, Langflow, Ruby, and SPIP.
## New module content (16)
## Forgejo Arbitrary File Read via Org-mode Include
Authors: NightRang3r and xbow-security
Type: Auxiliary
Pull request: #21778 contributed by jvoisin
gather/forgejo_orgmode_fileread_cve_2026_59774
Description: Adds module targeting CVE-2026-59774, an arbitrary file read in Forgejo 7.0 through 15.0.5 and 16.0.0–16.0.1.
## Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576)
Authors: Balachandar Gowrisankar and sinn3r [email protected]
Type: Auxiliary
Pull request: #21769 contributed by anirbala98
Hackernews
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
blogs_hackernews·2026-08-05·CVSS 7.4
CVE-2026-9198 [HIGH] CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation in the wild.
The list of vulnerabilities is as follows -
CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. (Fixed in July 2026 with version 1.10.1)
CVE-2026-34486 (CVS score: 7.5) - A missing encryption of sensitive data
2026-07-17
Published
2026-08-04
Added to CISA KEV
Exploited in the wild