IBM Langflow OSS 1.0.0 through 1.10.0

CVE-2026-9198 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability chains two default-enabled API endpoints: /api/v1/auto_login hands any unauthenticated caller a SUPERUSER JWT, and /api/v1/validate/code feeds attacker-supplied Python straight into exec(). The result is full remote code execution — typically as root inside the container — with zero credentials required. The fix is Langflow 1.10.1, which disables auto_login by default and sandboxes the code-validation endpoint.

IBM scored this 9.8 CRITICAL and CISA agreed emphatically, adding it to the KEV catalog on 2026-08-04 with a three-day remediation deadline (August 7). The vendor score is accurate and arguably generous to the defender — the attack requires no authentication, no user interaction, no special configuration, and works against every default Langflow deployment in the affected range. With ~1,200 internet-facing instances visible on Shodan as of July 2026, active exploitation campaigns deploying cryptominers and harvesting AWS credentials, and the JadePuffer ransomware gang leveraging related Langflow chains, this is a textbook CRITICAL.

Why this verdict

• Zero-friction exploit chain: Two HTTP requests — one to get a SUPERUSER token, one to execute arbitrary Python. No auth, no interaction, no special config. This is as low-complexity as RCE gets.
• Active exploitation confirmed: CISA KEV-listed 2026-08-04 with a 3-day deadline. Observed campaigns include cryptomining, AWS credential harvesting, and JadePuffer ransomware pivots.
• Default configuration is vulnerable: LANGFLOW_AUTO_LOGIN=true ships as the default. Every unmodified Langflow deployment in the affected range is exploitable out of the box.
• Role multiplier: Langflow is an AI pipeline orchestration server. In enterprise deployments it commonly stores LLM API keys, database credentials, cloud provider secrets, and connects to production data sources. Compromise of a Langflow instance grants lateral movement into cloud infrastructure, CI/CD pipelines, and data stores. This is functionally a build/orchestration server role — blast radius extends to fleet-scale credential compromise and supply-chain pivot via poisoned AI pipelines. ≥10% of Langflow installs serve this pipeline-orchestration role by definition, setting a CRITICAL floor.

Why not higher?

The score is already 9.8 CRITICAL, the maximum practical severity. The Scope metric is Unchanged (S:U) which is accurate — the vulnerability directly impacts the Langflow host, not a separate security domain. A 10.0 would require Changed scope.

Why not lower?

Downgrading is indefensible. The chain is unauthenticated, trivial to execute, actively exploited in the wild, KEV-listed with a 3-day deadline, and works against every default installation. The ~1,200 exposed instances represent a small but actively targeted population, and internal deployments behind corporate networks are equally vulnerable once an attacker has any internal foothold.

1. Block /api/v1/auto_login and /api/v1/validate/code at WAF or reverse proxy — These two endpoints are the entire exploit chain. Blocking them at the network edge eliminates the attack path immediately. Deploy within hours — this is a KEV with a 3-day CISA deadline.
2. Set LANGFLOW_AUTO_LOGIN=false and configure explicit authentication — Disabling auto_login breaks step 2 of the chain. Requires restarting the Langflow service and configuring a real authentication provider. Deploy immediately as a configuration change.
3. Remove Langflow from direct internet exposure — Place behind an authenticating reverse proxy (e.g., OAuth2 Proxy, Cloudflare Access, Tailscale) or VPN. No Langflow instance should be directly internet-reachable. This reduces the attack surface to authenticated internal users only.
4. Rotate all secrets stored in Langflow flows — Assume compromise if the instance was ever internet-exposed. Rotate LLM API keys, database credentials, cloud provider access keys, and any other secrets stored in flow definitions. Do this in parallel with patching.
5. Deploy container runtime security — Tools like Falco, Sysdig Secure, or CrowdStrike Falcon for Containers can detect unexpected child processes spawned from the Langflow Python process, catching post-exploitation even if the initial exploit succeeds.

Run this on any host with curl and network access to the target Langflow instance. Usage: bash check_cve_2026_9198.sh https://langflow.example.com:7860. No special privileges required — it only tests the auto_login endpoint response.

#!/usr/bin/env bash
# check_cve_2026_9198.sh — Test for CVE-2026-9198 (Langflow auto_login RCE chain)
# Usage: bash check_cve_2026_9198.sh <LANGFLOW_BASE_URL>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <LANGFLOW_BASE_URL>"
  echo "Example: $0 https://langflow.example.com:7860"
  exit 2
fi

BASE_URL="${1%/}"
AUTO_LOGIN_URL="${BASE_URL}/api/v1/auto_login"

echo "[*] Testing CVE-2026-9198 against: ${BASE_URL}"
echo "[*] Checking auto_login endpoint: ${AUTO_LOGIN_URL}"

# Attempt to hit the auto_login endpoint
HTTP_CODE=$(curl -sk -o /tmp/cve_2026_9198_response.json -w '%{http_code}' \
  -X POST "${AUTO_LOGIN_URL}" \
  -H 'Content-Type: application/json' \
  --max-time 10 2>/dev/null || echo "000")

if [ "${HTTP_CODE}" = "000" ]; then
  echo "UNKNOWN — Could not connect to ${BASE_URL}"
  rm -f /tmp/cve_2026_9198_response.json
  exit 2
fi

echo "[*] HTTP response code: ${HTTP_CODE}"

if [ "${HTTP_CODE}" = "200" ]; then
  # Check if the response contains an access token
  if grep -q '"access_token"' /tmp/cve_2026_9198_response.json 2>/dev/null; then
    echo "VULNERABLE — auto_login returned a SUPERUSER token without credentials."
    echo "[!] CVE-2026-9198 is exploitable on this instance."
    echo "[!] Patch to Langflow >= 1.10.1 or set LANGFLOW_AUTO_LOGIN=false immediately."
    rm -f /tmp/cve_2026_9198_response.json
    exit 1
  else
    echo "UNKNOWN — auto_login returned 200 but no access_token found in response."
    rm -f /tmp/cve_2026_9198_response.json
    exit 2
  fi
elif [ "${HTTP_CODE}" = "401" ] || [ "${HTTP_CODE}" = "403" ] || [ "${HTTP_CODE}" = "404" ] || [ "${HTTP_CODE}" = "405" ]; then
  echo "PATCHED — auto_login endpoint is disabled or requires authentication (HTTP ${HTTP_CODE})."
  rm -f /tmp/cve_2026_9198_response.json
  exit 0
else
  echo "UNKNOWN — Unexpected HTTP response code: ${HTTP_CODE}"
  rm -f /tmp/cve_2026_9198_response.json
  exit 2
fi

Sources

1. NVD — CVE-2026-9198
2. CISA KEV Alert (2026-08-04)
3. CIRCL Vulnerability Lookup — CVE-2026-9198
4. SentinelOne Vulnerability DB — CVE-2026-9198
5. BleepingComputer — CISA Orders Langflow Patch
6. VentureBeat — 7,000 Langflow Servers Under Attack
7. Senserva — Langflow KEV CVEs
8. IBM Support Advisory