CVE-2026-9198: Langflow unauthenticated remote code execution

Independent reconstruction, lab validation, and exposure disclosure for the Langflow code injection (CVE-2026-9198), a CVSS 9.8 unauthenticated remote code execution on default deployments of Langflow 1.0.0 through 1.10.0. Fixed in 1.10.1 and added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-04.

Research window: Aug 17-18, 2026. All exploitation was performed exclusively against lab instances we own.

Web write-up: https://riftweld.github.io/langflow-cve-2026-9198/

This is not the original discovery report. CVE-2026-9198 was publicly disclosed by IBM and CISA; this repository documents an independent root-cause reconstruction, lab reproduction, and coordinated hosting-provider notification campaign.

Contents

Path	Description
WRITEUP.md	Full write-up: root cause, the chain, lab differential, exposure, and the provider-route disclosure
LAB-VALIDATION.md	Lab log: reproduction on 1.10.0 and the patched 1.10.1 differential
poc/poc_takeover.py	End-to-end lab PoC (lab only, edit target host first)
poc/poc_transcript.md	Captured PoC run against our lab containers
recon/shodan_langflow_recon.py	Passive exposure enumeration (Shodan API, no active probing)
notifications/	Copies of the eight notification emails sent to hosting-provider abuse desks (per-instance tables withheld)

Summary of findings

• GET /api/v1/auto_login on default deployments (LANGFLOW_AUTO_LOGIN=true) returned a long-lived superuser JWT with no credentials.
• POST /api/v1/validate/code executed submitted function definitions and echoed command output back in the HTTP response: full unauthenticated code execution.
• The full chain (token, code execution, file write) was reproduced on langflowai/langflow:1.10.0 in an isolated lab; the 1.10.1 control closes both halves (short-lived tokens; empty exec sink).
• Exposure sweep: 1,768 Shodan matches collected, 244 hosts confirmed version-vulnerable (lower bound; 1,317 unresolved behind timeouts). The pool is cloud-VM dominated with no owner attribution, so notification ran through hosting providers: 8 consolidated reports covering 238 hosts, and two providers responded, one relaying a detailed operator remediation statement.

Using the PoC

Lab only. Start a vulnerable Langflow container, point the script at it:

docker run -d --name lf-lab -p 127.0.0.1:7860:7860 \
    -e LANGFLOW_AUTO_LOGIN=true langflowai/langflow:1.10.0

python3 poc/poc_takeover.py --url http://127.0.0.1:7860 --cmd "id"

Never run this against third-party systems. Exposure findings were handled via hosting-provider abuse channels; per-target records are intentionally not published.

Timeline

Date	Event
2026-06-23	Langflow 1.10.1 released (fix)
2026-07-02	IBM bulletin
2026-07-06	First in-the-wild sensor hits (pre-publication)
2026-07-17	CVE published
2026-07-29	Public nuclei template merged
2026-08-04	CISA KEV listing (remediation due 08-07)
2026-08-17/18	This independent reconstruction, lab validation, and provider notifications

License

Code is provided as-is for defensive and educational use.