CVE-2026-9198: IBM Langflow Code Injection Vulnerability
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Other sources
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
— CISA
Langflow OSS allows unauthenticated attackers to chain /api/v1/autologin (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9198?
CVE-2026-9198 has a critical severity rating of 9.8.
How do I fix CVE-2026-9198?
To remediate CVE-2026-9198, update IBM Langflow OSS to a secure version above 1.10.0.
What kind of attack does CVE-2026-9198 enable?
CVE-2026-9198 allows unauthenticated remote code execution due to an auto-login bypass combined with code validation.
Which versions of IBM Langflow are affected by CVE-2026-9198?
CVE-2026-9198 affects IBM Langflow OSS versions from 1.0.0 to 1.10.0.
What components are involved in the exploitation of CVE-2026-9198?
The exploitation of CVE-2026-9198 involves the /api/v1/auto_login and /api/v1/validate/code API endpoints.