Full Report
A critical Langflow flaw allowing RCE on default deployments is being exploited, says the CISA
Analysis Summary
# Vulnerability: Unauthenticated Remote Code Execution in Langflow
## CVE Details
- **CVE ID:** CVE-2026-9198
- **CVSS Score:** 10.0 (Critical - estimated based on unauthenticated RCE and CISA KEV inclusion)
- **CWE:** CWE-287 (Improper Authentication) and CWE-94 (Improper Control of Generation of Code)
## Affected Systems
- **Products:** Langflow OSS (Open Source Software)
- **Versions:** 1.0.0 through 1.10.0
- **Configurations:** Default deployments where "auto-login" is enabled and the code validation endpoint is accessible via the network.
## Vulnerability Description
The vulnerability is a chain of two distinct security issues within the Langflow architecture:
1. **Authentication Bypass:** Default deployments feature an auto-login endpoint that generates superuser authentication tokens for any requester without requiring credentials.
2. **Arbitrary Code Execution:** Once authenticated (via the aforementioned tokens), an attacker can access a code validation endpoint. This endpoint fails to properly sandbox or restrict inputs, allowing the execution of arbitrary Python code on the host system.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA Known Exploited Vulnerabilities catalog on August 4, 2026).
- **Complexity:** Low (Targeting default configurations).
- **Attack Vector:** Network (Unauthenticated remote access).
## Impact
- **Confidentiality:** Total (Full access to the AI platform and underlying host data).
- **Integrity:** Total (Ability to modify AI workflows and system files).
- **Availability:** Total (Ability to shut down services or delete data).
## Remediation
### Patches
- **Recommended Version:** Upgrade to Langflow **version 1.10.1** or later.
- **Current Stable:** Version 1.11.2 is currently available and includes the necessary fixes.
### Workarounds
- **Disable Auto-Login:** Ensure that the auto-login feature is disabled in production environments.
- **Network Segmentation:** Restrict access to the Langflow GUI and API endpoints to trusted internal networks only; avoid exposing default deployments to the public internet.
## Detection
- **Indicators of Compromise:**
- Unexpected superuser token generation logs from the auto-login endpoint.
- Unusual Python execution processes originating from the Langflow service user.
- Network traffic to the code validation endpoint from unrecognized IP addresses.
- **Detection Methods:** Audit Langflow logs for unauthorized access to the `/api/v1/login` or similar authentication endpoints.
## References
- **Vendor Advisory:** [https://www.ibm[.]com/support/pages/node/7278927]
- **CISA KEV Catalog:** [https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198]
- **CVE Record:** [https://www.cve[.]org/CVERecord?id=CVE-2026-9198]
- **Project Repository:** [https://pypi[.]org/project/langflow/]