Langflow CVE-2026-9198: Exploited Unauthenticated RCE

What to do

1. Check the version (pip show langflow, or the image tag) and upgrade to 1.10.1 or later: pip install -U 'langflow>=1.10.1'
2. Remove Langflow from the public internet; put it behind a VPN or an authenticating reverse proxy
3. Set LANGFLOW_AUTO_LOGIN=false and configure real superuser credentials
4. If the instance was reachable while vulnerable, treat it as compromised: rebuild, and rotate every API key and credential stored in flows and environment
5. Hunt for persistence on the host (new users, cron jobs, unexpected processes) before reconnecting it

How to check if you are affected or compromised

• Search access logs for requests to /api/v1/auto_login followed by POST /api/v1/validate/code from unfamiliar IPs
• Look for POSTs to /api/v1/build_public_tmp/ with a data parameter (CVE-2026-33017)
• Check for child processes of the Langflow Python process (sh, bash, curl, wget) and outbound connections to unknown hosts

What happened#

On August 4, 2026, CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. The flaw is an unauthenticated remote code execution bug in Langflow, the visual builder for LLM agents and RAG pipelines. CISA gave federal agencies until August 7 to fix it and flagged the entry for forensic triage, meaning patching alone is not considered enough.

IBM, which now maintains Langflow, had published its security bulletin on July 2, rating the flaw CVSS 9.8. The bug chains two endpoints:

1. /api/v1/auto_login issues a superuser bearer token to any network caller.
2. /api/v1/validate/code accepts that token and runs submitted Python. Decorators, default arguments and annotations execute at function-definition time, so "validating" code means running it.

The bulletin says this works on default deployments where auto-login is enabled and the endpoint is reachable.

The Hacker News cites KEVIntel telemetry: about 650 exploitation attempts since July 6, 2026, from 244 IP addresses in 41 countries. That means probing began before the CVE record was published on July 17. The same report describes an AI-driven intrusion campaign that first tried an older Langflow bug, CVE-2026-33017, before moving on to other targets.

Who is affected#

IBM lists Langflow OSS 1.0.0 through 1.10.0 on all platforms as affected. The fix is 1.10.1, and the bulletin says "None" under workarounds.

This is the fifth Langflow entry added to KEV in 2026, per CISA's catalog:

CVE	Issue	Added to KEV
CVE-2026-33017	Unauthenticated exec() via build_public_tmp, before 1.9.0	Mar 25
CVE-2025-34291	CORS/refresh-token flaw leading to code execution	May 21
CVE-2026-55255	IDOR that runs other users' flows, before 1.9.1	Jul 7
CVE-2026-0770	Unauthenticated exec_globals RCE	Jul 21
CVE-2026-9198	Auto-login plus code validation chain	Aug 4

Its 2025 KEV entry, CVE-2025-3248, is marked as used in ransomware campaigns.

Do you really need to act?#

Yes, if Langflow is reachable by anyone you do not fully trust. This flaw has none of the soft preconditions common to AI CVEs: there is no prompt injection, no user click and no special configuration. The default setup is the vulnerable one, and attackers were scanning for it before the CVE record existed.

Langflow instances also tend to hold the keys to everything a flow touches: LLM providers, vector databases, SaaS APIs and cloud credentials.

The narrow exception is a single-user install bound to 127.0.0.1 on a laptop. Patch it anyway; it is not an emergency. The pattern of five exploited bugs in eight months is the larger lesson. Langflow's design puts code execution one authorization check away, so do not expose it to the internet even when patched.

What to do now#

1. Check the version with pip show langflow or your container tag. Upgrade with pip install -U "langflow>=1.10.1" or pull the 1.10.1+ image.
2. Take it off the public internet. Put it behind a VPN or an authenticating proxy.
3. As extra hardening, set LANGFLOW_AUTO_LOGIN=false and configure real superuser credentials. IBM lists no official workaround, so this does not replace upgrading.
4. If it was exposed while vulnerable, assume compromise. Rebuild from a clean image and rotate every credential stored in flows, global variables and the environment.
5. Check for persistence before reconnecting: new accounts, cron entries and unfamiliar processes.

How to tell if you were hit#

In proxy or app logs, look for these patterns from unfamiliar IPs:

• GET /api/v1/auto_login followed by POST /api/v1/validate/code
• POSTs to /api/v1/build_public_tmp/ that carry a data body (CVE-2026-33017)

On the host, child processes of Langflow's Python process, such as sh, curl or wget, and outbound connections to unknown IPs are strong indicators. Also review provider dashboards for use of the API keys Langflow held.

Timeline#

• Mar 25, 2026: CISA adds CVE-2026-33017 to KEV.
• Jul 2, 2026: IBM bulletin published; Langflow 1.10.1 fixes CVE-2026-9198.
• Jul 6, 2026: Exploitation attempts begin, per KEVIntel telemetry.
• Jul 17, 2026: CVE-2026-9198 record published.
• Aug 4, 2026: CISA adds CVE-2026-9198 to KEV; federal due date Aug 7.

Vulnerability records

• CVE-2026-9198 · KEV 2026-08-04 · IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with…
• CVE-2026-33017 · KEV 2026-03-25 · Langflow is a tool for building and deploying AI-powered agents and workflows.
• CVE-2026-0770 · KEV 2026-07-21 · Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability.
• CVE-2026-55255 · KEV 2026-07-07 · Langflow is a tool for building and deploying AI-powered agents and workflows.
• CVE-2025-34291 · KEV 2026-05-21 · Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. IBM — Security Bulletin: Unauthenticated RCE via auto-login bypass and code validation (Langflow OSS) ibm.com
2. CISA — Known Exploited Vulnerabilities catalog (JSON feed, checked 2026-10-21) cisa.gov
3. CVE.org — CVE-2026-9198 record cve.org
4. CVE.org — CVE-2026-33017 record cve.org

Coverage and analysis

1. The Hacker News — CISA flags Langflow RCE, Tomcat and N-able N-central flaws thehackernews.com