CVE-2026-9198 - IBM Langflow OSS Unauthenticated Remote Code Execution (RCE)

Critical unauthenticated remote code execution vulnerability affecting IBM Langflow OSS.

The vulnerability results from chaining two weaknesses:

1. /api/v1/auto_login can issue a privileged SUPERUSER bearer token to an unauthenticated network caller.
2. /api/v1/validate/code processes attacker-controlled Python code in an unsafe execution context.

When chained, these weaknesses can result in arbitrary Python code execution with the privileges of the Langflow backend process.

The vulnerability has a CVSS v3.1 score of 9.8 (Critical) and is classified as CWE-94 — Improper Control of Generation of Code.

Affected Versions

IBM recommends upgrading to Langflow OSS 1.10.1.

Severity

CVSS: 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Chain

Unauthenticated attacker
        |
        v
/api/v1/auto_login
        |
        |  SUPERUSER bearer token
        v
/api/v1/validate/code
        |
        |  Unsafe Python evaluation
        v
Remote Code Execution
        |
        v
Langflow backend process

The important security issue is not simply that either endpoint exists. The impact comes from the combination of an authentication bypass/token issuance primitive with an unsafe code-validation mechanism.

Security Impact

Successful exploitation can provide an attacker with code execution in the security context of the Langflow backend.

Depending on the deployment, this may expose:

• Application secrets
• Environment variables
• API credentials
• Files accessible to the Langflow process
• Internal network resources
• Connected AI/LLM services
• Databases and vector stores
• Other services reachable from the host

The practical impact therefore depends heavily on the privileges and network access available to the Langflow process.

Safe HTTP Fingerprinting

The following requests are intended for non-destructive identification and do not contain a code-execution payload.

Check the Langflow service

GET / HTTP/1.1
Host: TARGET
Accept: */*
Connection: close

Inspect API metadata

GET /docs HTTP/1.1
Host: TARGET
Accept: text/html,*/*
Connection: close

Check the auto-login route without supplying an execution payload

GET /api/v1/auto_login HTTP/1.1
Host: TARGET
Accept: application/json
Connection: close

For defensive testing, record the status code, headers, and response structure rather than attempting to use any returned credential material.

Detection-oriented request

A useful defensive telemetry pattern is:

/api/v1/auto_login
        followed shortly by
/api/v1/validate/code

A source making these requests without the normal Langflow frontend traffic around them is particularly worth investigating.

What Not To Do in Production

Do not test the vulnerability by submitting arbitrary Python to /api/v1/validate/code against a production instance.

A safe validation workflow is:

1. Identify the Langflow version
2. Confirm whether it is <= 1.10.0
3. Review access logs for the affected endpoints
4. Check for unexpected SUPERUSER token issuance
5. Check process/application logs for suspicious Python execution
6. Upgrade to 1.10.1
7. Rotate potentially exposed credentials
8. Investigate the host if exploitation is suspected

Detection

Monitor for:

POST /api/v1/validate/code
GET  /api/v1/auto_login
POST /api/v1/auto_login

Particularly suspicious behavior includes:

• Unauthenticated requests to /api/v1/auto_login
• 200 OK responses containing an access_token
• An auto_login request immediately followed by /api/v1/validate/code
• Requests originating from unexpected external addresses
• Non-browser user agents
• Python/code-related error messages in Langflow responses
• Unexpected child processes spawned by the Langflow service

Remediation

Upgrade Langflow OSS to:

1.10.1 or later

IBM specifically recommends upgrading to 1.10.1.

If exploitation is suspected, patching alone should not be considered sufficient. Review logs and host telemetry and rotate secrets that may have been accessible to the Langflow process.

Disclosure / Status

• CVE: CVE-2026-9198
• CWE: CWE-94
• Severity: Critical
• CVSS: 9.8
• Affected: Langflow OSS 1.0.0–1.10.0
• Fixed: 1.10.1
• CISA KEV: Yes
• Exploitation: Reported as active

CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4, 2026.

References

• NVD: CVE-2026-9198
• IBM Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
• GitHub Advisory: GHSA-5wm9-vgmg-cjv6
• CISA Known Exploited Vulnerabilities Catalog

Disclaimer

This repository is intended for authorized security research, vulnerability analysis, detection engineering, and controlled laboratory environments.