ywh-jfellus/cve-2026-9198Proof of Concept for CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass
This repository provides an educational proof of concept for CVE-2026-9198 affecting IBM Langflow OSS.
The PoC (poc.py) demonstrates how an unauthenticated attacker can chain:
GET/POST /api/v1/auto_login (returns a superuser token when auto-login is enabled), andPOST /api/v1/validate/code (executes attacker-controlled Python code)to achieve remote code execution.
This code and the provided Docker stacks are for local security testing and education only.
Do not run against systems you do not own or explicitly have permission to test.
.
├── poc.py
├── vulnerable/docker-compose.yaml
└── patched/docker-compose.yaml
poc.py: exploit PoC.vulnerable/docker-compose.yaml: lab stack using langflowai/langflow:1.10.0 (vulnerable).patched/docker-compose.yaml: lab stack using langflowai/langflow:1.10.1 (patched behavior target).Both compose files are intentionally set up as labs to test poc.py on http://127.0.0.1:9999.
pip install requests
Start the vulnerable environment:
docker compose -f vulnerable/docker-compose.yaml up -d
Run the PoC:
python3 poc.py
Expected vulnerable result includes a red [!] line and command output similar to:
[!] /api/v1/auto_login is vulnerable: uid=... gid=...
Stop the vulnerable stack first (if running):
docker compose -f vulnerable/docker-compose.yaml down -v
Start the patched environment:
docker compose -f patched/docker-compose.yaml up -d
Run the same PoC:
python3 poc.py
Expected patched result is a green [-] line indicating the exploit chain no longer succeeds.
In poc.py:
URL defaults to http://127.0.0.1:9999CMD defaults to idAdjust these constants if you need to test a different local target or command.