CVE-2026-9198: IBM Langflow Code Injection Vulnerability
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Other sources
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.1 - Compensating control
Evaluate each asset for internet exposure and ensure adherence to CISA BOD 26-04 patching guidance for the internet-exposed Langflow deployments.
- Compensating control
If mitigations are unavailable for a given asset, discontinue use of the Langflow product in accordance with BOD 26-04 guidance for cloud services or discontinue use when mitigations cannot be applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9198?
CVE-2026-9198 has a critical severity rating of 9.8.
How do I fix CVE-2026-9198?
To remediate CVE-2026-9198, update IBM Langflow OSS to a secure version above 1.10.0.
What kind of attack does CVE-2026-9198 enable?
CVE-2026-9198 allows unauthenticated remote code execution due to an auto-login bypass combined with code validation.
Which versions of IBM Langflow are affected by CVE-2026-9198?
CVE-2026-9198 affects IBM Langflow OSS versions from 1.0.0 to 1.10.0.
What components are involved in the exploitation of CVE-2026-9198?
The exploitation of CVE-2026-9198 involves the /api/v1/auto_login and /api/v1/validate/code API endpoints.