CVE-2026-9198 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-17

Added to CISA KEV: 2026-08-04 18 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unauthorized calls to /api/v1/auto_login and /api/v1/validate/code, check for unexpected processes/child processes of the Langflow application, verify system integrity, and inspect for web shells or reverse shells.
Immediately upgrade IBM Langflow OSS to version 1.10.1 or later per the IBM security bulletin (https://www.ibm.com/support/pages/node/7278927).
If patching is not immediately feasible, disable the auto-login feature and restrict network access to the API endpoints (firewall rules, reverse proxy authentication, VPN-only access). Remove any direct internet exposure of Langflow instances.
Monitor for outbound connections from the Langflow host, unusual exec()-driven activity, and new persistence mechanisms; rotate any credentials/secrets accessible to the Langflow process.
Patch priority: EMERGENCY / P1 — actively exploited, unauthenticated RCE, automatable, and publicly weaponized.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-9198 is a critical unauthenticated remote code execution (RCE) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0 ^[1]^[4]. The vulnerability arises because the application allows an attacker to chain two endpoints: `/api/v1/auto_login`, which mints a SUPERUSER token for any caller, and `/api/v1/validate/code`, which executes arbitrary user-supplied code via `exec()`. This allows unauthorized actors to achieve full remote code execution on default deployments, posing a severe security risk ^[1]^[2].

Exploitation

Active Exploitation: The vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild ^[3].
Proof-of-Concept: Multiple proof-of-concept (PoC) exploit scripts are publicly available on platforms such as GitHub ^[5]^[6].
Attack Prerequisites:

* Network Access: Requires network access to the Langflow instance (specifically the `/api/v1/auto_login` and `/api/v1/validate/code` endpoints). * Authentication: None required; the attacker can bypass authentication by minting their own token ^[2]. * User Interaction: None required. * Configuration: Exploitable on default deployments where the auto-login feature is enabled and the validation endpoint is network-accessible ^[1].

Affected Products & Patches

Affected Versions: IBM Langflow OSS versions 1.0.0 through 1.10.0 ^[4].
Patch/Fix: Users are advised to update to a patched version of Langflow OSS as provided by the project maintainers ^[1].
Mitigations: In environments where patching is not immediately feasible, disabling the auto-login feature or restricting network access to the API endpoints serves as an effective temporary mitigation ^[1].

Impact

Capability: Successful exploitation grants an attacker full remote code execution (RCE) with the privileges of the Langflow application process, allowing them to execute arbitrary commands on the underlying server.
Business Risk: For internet-facing deployments, this vulnerability allows external attackers to fully compromise the server, potentially leading to data exfiltration, deployment of ransomware, lateral movement within the network, or complete loss of system control ^[1].

Sources

Security Bulletin: Unauthenticated Remote Code Execution via Auto ... - IBM
Vulnerability Details CVEID: CVE-2026-9198 DESCRIPTION: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow…
NVD-CVE-2026-9198
CVE-2026-9198 Detail Description IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec ()) to achieve full RCE on default Langflow deployments…
CVE-2026-9198 | Critical Unauthenticated RCE in IBM Langflow OSS
Blog Threat Research CVE-2026-9198 | Critical Unauthenticated RCE in IBM Langflow OSS Sep 6, 2026 10 minute read SAFE Safe Security ... Disclosed on 2026-07-17 and reported to IBM by security researcher Harish Kolla, the flaw was added to the CISA Known Exploited Vulnerabilities ...
NVD-CVE-2026-9198 - National Vulnerability Database
CVE-2026-9198 Detail Description IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints ...
GitHub - ywh-jfellus/CVE-2026-9198: Proof of Concept for CVE-2026-9198 ...
This repository provides an educational proof of concept for CVE-2026-9198 affecting IBM Langflow OSS. The PoC (poc.py) demonstrates how an unauthenticated attacker can chain: GET/POST /api/v1/auto_login (returns a superuser token when auto-login is enabled), and POST /api/v1/validate/code (executes…

🔴 CVE-2026-9198