CVE-2026-9198

Vulnerability cause:

IBM Langflow OSS is an open-source software specifically used for building and deploying Agent automation workflows.

IBM Langflow OSS from 1.0.0 to 1.10.0 has automatic login enabled by default (autologin is true).
In this mode, accessing the /api/v1/auto_login endpoint directly returns a superuser token.
Using this token, you can access the /api/v1/validate/code endpoint.

POST /api/v1/validate/code is a validation endpoint, but it will compile and exec-validate each validate_code function definition in the submitted source code.
Submitting malicious code to this endpoint will cause the validation endpoint to compile and execute the malicious code, achieving RCE.
This framework is developed in Python, so the PoC uses Python code to inject malicious code.