CVE-2026-9198
IBM Langflow Code Injection Vulnerability
Description
CVE-2026-9198 is a critical code injection vulnerability in IBM Langflow that lets an unauthenticated, remote attacker achieve full remote code execution (RCE) on default deployments by chaining two exposed API endpoints. In affected versions (Langflow OSS 1.0.0 through 1.10.0), an attacker first calls /api/v1/auto_login, which mints SUPERUSER tokens for any network caller, and then uses /api/v1/validate/code, which executes user-supplied code via exec(), to run arbitrary code. Because no authentication and no user interaction are required, any attacker who can reach a default Langflow instance over the network can take complete control of the host, threatening confidentiality, integrity, and availability. With a CVSS score of 9.8 and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-9198 is an actively exploited RCE flaw that demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| langflow | langflow | >= 1.0.0, < 1.10.1 |
References
- https://www.ibm.com/support/pages/node/7278927(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when software incorporates externally-influenced input into a code segment without properly neutralizing elements that alter its behavior, targeting the language interpreter itself. In CVE-2026-9198, IBM Langflow's /api/v1/validate/code endpoint passes attacker-supplied input to Python's exec(), so combined with the token-minting auto_login endpoint, an unauthenticated attacker can inject and execute arbitrary code.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
The impact of CVE-2026-9198 is critical: the attack vector is network-based, making it remotely exploitable without physical access, and with attack complexity low it is easy to exploit without special conditions. Privileges required is none and user interaction is none, so an attacker needs no authentication and no help from a victim — the auto_login endpoint hands out SUPERUSER tokens to any network caller. A successful exploit results in high impact to confidentiality, integrity, and availability, giving the attacker the ability to read sensitive data, tamper with the application, and disrupt service, amounting to full compromise of the Langflow host. Rated CVSS 9.8 (Critical) with an EPSS score of roughly 17% (around the 97th percentile) and confirmed in the CISA KEV catalog as actively exploited, CVE-2026-9198 carries a high likelihood of exploitation and should be remediated immediately.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-9198 by adding it to the Known Exploited Vulnerabilities catalog, so organizations running affected IBM Langflow versions should assume attackers are already targeting exposed instances. The EPSS score of approximately 17% (around the 97th percentile) indicates a high probability of exploitation activity, consistent with the low effort required to chain the auto-login and code-validation endpoints. The KEV ransomware flag is currently "Unknown," but the ease of achieving unauthenticated RCE on default deployments makes this an especially attractive target. No dedicated public exploit link is listed among the references, yet given the confirmed exploitation status and the straightforward attack chain, defenders should treat working exploit techniques as readily available and prioritize patching.
Remediation
- Apply the IBM mitigations immediately. Per CISA's KEV required action, follow the vendor's instructions in line with BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable.
- Upgrade Langflow to a fixed release. All versions from 1.0.0 through 1.10.0 are affected; upgrade to Langflow 1.10.1 or later, which is outside the vulnerable range.
- Remove Langflow from untrusted network exposure. Because default deployments are exploitable, place Langflow behind a VPN, firewall, or authenticated reverse proxy so that the
auto_loginandvalidate/codeendpoints cannot be reached by arbitrary internet hosts. - Avoid dynamic code execution and enforce real authentication. In line with CWE-94 guidance, ensure user-supplied input is never passed to
exec()or similar functions, and verify that automatic-login behavior granting SUPERUSER tokens is disabled and replaced with proper authentication. - Hunt for signs of compromise, reviewing logs for unexpected calls to
/api/v1/auto_loginand/api/v1/validate/code, unusual process execution, or new persistence on hosts running Langflow, since active exploitation is confirmed.
Technical Details
CVE-2026-9198 is a code injection vulnerability (CWE-94) that becomes a full unauthenticated RCE by chaining two flaws in IBM Langflow. The /api/v1/auto_login endpoint mints SUPERUSER tokens to any network caller, effectively removing authentication, and the /api/v1/validate/code endpoint executes user-supplied code through Python's exec(); together they allow an attacker to obtain a privileged token and then submit arbitrary code for execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the attack is network-reachable with low complexity and no authentication or user interaction, and that it fully impacts confidentiality, integrity, and availability. This chaining pattern is what elevates the risk: the auto-login weakness supplies the access the code-execution endpoint would otherwise require, so on default deployments a single sequence of requests yields code execution with application privileges.
Frequently Asked Questions
Is CVE-2026-9198 being actively exploited?
Yes. CISA has added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Its EPSS score of about 17% (around the 97th percentile) further indicates a high likelihood of ongoing exploitation activity.
What products are affected by CVE-2026-9198?
The vulnerability affects IBM Langflow OSS versions 1.0.0 through 1.10.0. Default deployments in this range are exploitable, as the auto_login endpoint issues SUPERUSER tokens to any network caller.
How do I fix CVE-2026-9198?
Upgrade Langflow to version 1.10.1 or later, which is outside the affected range, following CISA's KEV guidance under BOD 26-04. Until patched, remove Langflow from untrusted network exposure and disable the automatic-login behavior that grants privileged tokens.
How severe is CVE-2026-9198?
It is Critical, with a CVSS 3.1 base score of 9.8. The vulnerability is unauthenticated, network-exploitable, and low-complexity, enabling full remote code execution with high confidentiality, integrity, and availability impact, and its EPSS score around the 97th percentile makes it a top remediation priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.