CVE-2026-9103: Unauthenticated Superuser Token Issuance via Auto-Login Endpoint
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.
Other sources
Langflow could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.1 - Configuration
Disable AUTO_LOGIN so the /api/v1/login/auto_login endpoint no longer issues long-lived superuser bearer tokens without requiring authentication.
Langflow OSS AUTO_LOGIN = enabled (default) -> disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9103?
CVE-2026-9103 has a critical severity rating of 9.8.
How do I fix CVE-2026-9103?
To fix CVE-2026-9103, disable the AUTO_LOGIN configuration in your IBM Langflow OSS installation.
What vulnerabilities does CVE-2026-9103 expose?
CVE-2026-9103 exposes the ability for remote attackers to gain unauthorized access by issuing superuser tokens.
What versions of IBM Langflow OSS are affected by CVE-2026-9103?
CVE-2026-9103 affects IBM Langflow OSS versions 1.0.0 through 1.10.0.
Can CVE-2026-9103 lead to data breaches?
Yes, CVE-2026-9103 can lead to data breaches due to unauthorized access gained through superuser tokens.