CVE-2026-9198: IBM Langflow — Unauthenticated Remote Code Execution

Background

Langflow is an open-source visual platform for building LLM-powered applications. Originally developed independently and later stewardarded by IBM, it provides a drag-and-drop interface for constructing AI pipelines, RAG workflows, and agent chains. Deployments are common in enterprise AI development environments and research teams standing up LLM applications quickly. The platform exposes an HTTP API that underlies both the web interface and external integrations.

Langflow versions 1.0.0 through 1.10.0 contain a critical unauthenticated remote code execution vulnerability. CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities catalog on August 4, 2026, with a mandatory remediation deadline of August 7, 2026.

Technical Mechanism

CWE-94 (Improper Control of Generation of Code) applies here via a two-stage exploitation chain involving two unauthenticated API endpoints.

Stage 1: Authentication bypass via /api/v1/auto_login

Langflow includes an endpoint intended for local development that mints a SUPERUSER session token without requiring credentials. In default deployments, this endpoint is reachable from the network without authentication. An attacker sends a request to /api/v1/auto_login and receives a valid SUPERUSER bearer token in response.

Stage 2: Arbitrary code execution via /api/v1/validate/code

The /api/v1/validate/code endpoint accepts Python code and executes it using Python’s exec() built-in for validation purposes. With a SUPERUSER token obtained in Stage 1, an attacker submits a POST request containing arbitrary Python code. The platform executes it in the server process context.

The combination grants full server-side code execution with the privileges of the Langflow process, typically running as a service account with broad filesystem and network access in containerised deployments.

Real-World Exploitation Evidence

CISA’s KEV addition on August 4, 2026, confirms active exploitation in the wild. The vulnerability is notable for its simplicity: the two-request chain requires no pre-existing knowledge of the target environment and works against any default Langflow deployment.

No specific threat actor attribution has been published at time of writing. The nature of the vulnerability, requiring only two HTTP requests with no authentication, makes it attractive for opportunistic mass-scanning campaigns. Langflow instances are commonly exposed on internet-accessible ports during development and are frequently deployed without network-level restrictions.

The CISA remediation deadline of August 7, 2026, three days after KEV addition, reflects the severity and exploitation activity.

Impact Assessment

On a compromised Langflow instance an attacker achieves arbitrary code execution as the service process. Depending on deployment context this enables:

• Exfiltration of LLM API keys, database credentials, and environment variables stored in the Langflow configuration
• Access to any connected data sources configured in the AI pipelines (vector databases, document stores, SQL databases)
• Lateral movement within the network from the Langflow host
• Modification or destruction of AI pipeline configurations and training data
• Use of the host as a pivot point for further network reconnaissance

Enterprise deployments connecting Langflow to production data sources face elevated risk: the platform is often provisioned with broad access to enable pipeline flexibility, making post-exploitation impact significantly larger than on isolated development instances.

Affected Versions

Remediation Steps

1. Upgrade immediately: Update Langflow to version 1.10.1 or later. The patch removes the unauthenticated access to /api/v1/auto_login and restricts /api/v1/validate/code to authenticated sessions with appropriate privilege checks.

2. Network-level restriction: If upgrade is not immediately possible, restrict network access to the Langflow API port. The platform should not be internet-accessible. Place it behind a VPN or internal network boundary.

3. Environment variable audit: Review environment variables and secrets accessible to the Langflow process. Rotate any API keys, database credentials, or tokens that may have been exposed.

4. Deployment review: Audit which data sources and external services are connected to Langflow pipelines. Identify the blast radius if the host were compromised.

5. Authentication configuration: Ensure LANGFLOW_AUTO_LOGIN is set to false in production configurations. This environment variable controls the auto-login behavior and should be disabled in any non-development deployment.

Detection Guidance

Network log indicators:

Look for requests to /api/v1/auto_login originating from unexpected sources, particularly external IP addresses. A successful auto-login followed immediately by a request to /api/v1/validate/code is a strong indicator of exploitation.

POST /api/v1/auto_login HTTP/1.1
POST /api/v1/validate/code HTTP/1.1

Application log indicators:

Langflow application logs will show successful auto-login events. Check for auto-login events not corresponding to known developer workstations or CI/CD systems.

Endpoint detection:

On the Langflow host, monitor for unexpected process spawning from the Langflow service process. Python child processes executing network connections or file system operations outside the normal Langflow data directory are suspicious.

SIEM query (generic web log):

uri_path:(*/auto_login OR */validate/code) 
AND method:POST 
| stats count by src_ip, uri_path 
| where count > 1

Alert on any source IP that hits /api/v1/auto_login followed by /api/v1/validate/code within a short window.

Timeline

References

• NVD Entry — CVE-2026-9198
• IBM Support Advisory
• CISA Known Exploited Vulnerabilities Catalog
• CISA BOD 26-04 Guidance