CVE-2026-9202: Unauthenticated User Registration Could Lead to Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEWUSERISACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTOLOGIN.
Other sources
Langflow OSS allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEWUSERISACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTOLOGIN.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9202?
CVE-2026-9202 has a critical severity rating of 9.8.
How do I fix CVE-2026-9202?
To mitigate CVE-2026-9202, restrict unauthenticated user registrations by disabling the NEW_USER_IS_ACTIVE setting.
What could happen if CVE-2026-9202 is exploited?
Exploitation of CVE-2026-9202 could allow unauthenticated attackers to create user accounts that enable remote code execution.
Which versions of IBM Langflow OSS are affected by CVE-2026-9202?
IBM Langflow OSS versions 1.0.0 through 1.10.0 are affected by CVE-2026-9202.
Is it possible for an attacker to bypass authentication due to CVE-2026-9202?
Yes, attackers can bypass authentication by using newly created accounts to access RCE endpoints.