Langflow unauthenticated RCE exploited in wild (CVE-2026-9198) [PoC]

Actively exploited in the wild - CVE-2026-9198 is a critical unauthenticated remote code execution vulnerability in IBM Langflow OSS 1.0.0 through 1.10.0 that lets any network caller chain two API endpoints to execute arbitrary commands on the host. No vendor patch is available yet; apply the mitigations below immediately.

Overview

CVE-2026-9198 targets default Langflow deployments, which are popular open-source platforms for building AI and LLM workflows. The attack chains two API endpoints that require no authentication:

1. /api/v1/auto_login - this endpoint mints SUPERUSER tokens to any caller on the network, effectively bypassing all authentication controls.
2. /api/v1/validate/code - this endpoint executes user-supplied code via Python’s exec() function.

By chaining these endpoints, an unauthenticated attacker obtains a SUPERUSER token and then executes arbitrary code with the privileges of the Langflow service account. On default deployments, this translates to full remote code execution (RCE) on the underlying server.

The vulnerability carries a CVSS score of 9.8 (Critical) with a network attack vector, low attack complexity, no privileges required, and no user interaction needed. CISA has added CVE-2026-9198 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The EPSS model estimates a 1.9% probability of exploitation in the next 30 days, though the confirmed in-the-wild activity makes immediate action necessary.

Impact

Successful exploitation grants the attacker:

• Full remote code execution on the host system
• Access to any data the Langflow service can reach, including databases, file systems, and connected AI models
• Ability to pivot laterally within the network using the compromised service account
• Persistence through dropped web shells or backdoored workflows

Given that Langflow often integrates with sensitive AI pipelines and data stores, the blast radius extends well beyond the application itself.

Remediation

No patched version of IBM Langflow OSS has been released as of this advisory. Until a fix is available:

1. Restrict network access - Place Langflow behind a firewall or VPN. Do not expose it to the internet or untrusted networks. The /api/v1/auto_login and /api/v1/validate/code endpoints should be blocked at the reverse proxy level.
2. Disable auto_login - If configuration permits, disable the auto-login feature entirely.
3. Monitor for suspicious activity - Review logs for unexpected hits to /api/v1/auto_login or /api/v1/validate/code from unauthenticated sources.
4. Apply vendor patches when released - Monitor IBM’s security advisories for Langflow and deploy the fix as soon as it becomes available.

Additional information on affected deployments and indicators of compromise can be found in our breach reports and security news.

Security Insight

This vulnerability highlights a dangerous pattern in AI/LLM development platforms: convenience features that bypass authentication are being shipped as defaults. The auto_login endpoint, designed for rapid prototyping, becomes a critical attack surface in production. The same code-execution validation endpoint that helps developers test workflows turns into an RCE primitive when authentication is circumvented. Organizations adopting AI platforms must treat them as high-value targets and audit default configurations before deployment, not after.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs