---
title: "Langflow CVE-2026-9198: Exploited Unauthenticated RCE"
url: https://erroneo.us/security/briefs/langflow-cve-2026-9198-kev-unauthenticated-rce/
description: "Langflow 1.0.0-1.10.0 hands superuser tokens to anyone, then runs their code (CVE-2026-9198, KEV). Fifth Langflow KEV entry of 2026. Upgrade to 1.10.1 now."
type: security-brief
section: "Security Digest"
date_published: 2026-08-04
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-9198", "CVE-2026-33017", "CVE-2026-0770", "CVE-2026-55255", "CVE-2025-34291"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Langflow CVE-2026-9198: Exploited Unauthenticated RCE

**Verdict: Act now.** Langflow is now the most repeatedly exploited AI-agent builder on CISA's list; any network-reachable instance below 1.10.1 should be patched today and checked for compromise.

- **Who must act:** Anyone running self-hosted Langflow 1.0.0 through 1.10.0 that is reachable from the internet or an untrusted network.
- **Who can relax:** Instances already on 1.10.1 or later that are bound to localhost on a single-user machine; people who do not run Langflow.
- **Affected:** IBM Langflow OSS 1.0.0 through 1.10.0 (CVE-2026-9198); Langflow before 1.9.0 (CVE-2026-33017); Langflow before 1.9.1 (CVE-2026-55255)
- **Fixed:** Langflow OSS 1.10.1
- **CVEs:** CVE-2026-9198, CVE-2026-33017, CVE-2026-0770, CVE-2026-55255, CVE-2025-34291
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version (pip show langflow, or the image tag) and upgrade to 1.10.1 or later: pip install -U 'langflow>=1.10.1'
2. Remove Langflow from the public internet; put it behind a VPN or an authenticating reverse proxy
3. Set LANGFLOW_AUTO_LOGIN=false and configure real superuser credentials
4. If the instance was reachable while vulnerable, treat it as compromised: rebuild, and rotate every API key and credential stored in flows and environment
5. Hunt for persistence on the host (new users, cron jobs, unexpected processes) before reconnecting it

### How to check if you are affected

- Search access logs for requests to /api/v1/auto_login followed by POST /api/v1/validate/code from unfamiliar IPs
- Look for POSTs to /api/v1/build_public_tmp/ with a data parameter (CVE-2026-33017)
- Check for child processes of the Langflow Python process (sh, bash, curl, wget) and outbound connections to unknown hosts

## What happened

On August 4, 2026, CISA added [CVE-2026-9198](https://www.cve.org/CVERecord?id=CVE-2026-9198) to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json). The flaw is an unauthenticated remote code execution bug in Langflow, the visual builder for LLM agents and RAG pipelines. CISA gave federal agencies until August 7 to fix it and flagged the entry for forensic triage, meaning patching alone is not considered enough.

IBM, which now maintains Langflow, had published its [security bulletin](https://www.ibm.com/support/pages/node/7278927) on July 2, rating the flaw CVSS 9.8. The bug chains two endpoints:

1. `/api/v1/auto_login` issues a superuser bearer token to any network caller.
2. `/api/v1/validate/code` accepts that token and runs submitted Python. Decorators, default arguments and annotations execute at function-definition time, so "validating" code means running it.

The bulletin says this works on default deployments where auto-login is enabled and the endpoint is reachable.

[The Hacker News](https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html) cites KEVIntel telemetry: about 650 exploitation attempts since July 6, 2026, from 244 IP addresses in 41 countries. That means probing began before the CVE record was published on July 17. The same report describes an AI-driven intrusion campaign that first tried an older Langflow bug, CVE-2026-33017, before moving on to other targets.

## Who is affected

IBM lists Langflow OSS 1.0.0 through 1.10.0 on all platforms as affected. The fix is 1.10.1, and the bulletin says "None" under workarounds.

This is the fifth Langflow entry added to KEV in 2026, per CISA's catalog:

| CVE | Issue | Added to KEV |
|---|---|---|
| [CVE-2026-33017](https://www.cve.org/CVERecord?id=CVE-2026-33017) | Unauthenticated `exec()` via `build_public_tmp`, before 1.9.0 | Mar 25 |
| CVE-2025-34291 | CORS/refresh-token flaw leading to code execution | May 21 |
| CVE-2026-55255 | IDOR that runs other users' flows, before 1.9.1 | Jul 7 |
| CVE-2026-0770 | Unauthenticated `exec_globals` RCE | Jul 21 |
| CVE-2026-9198 | Auto-login plus code validation chain | Aug 4 |

Its 2025 KEV entry, CVE-2025-3248, is marked as used in ransomware campaigns.

## Do you really need to act?

Yes, if Langflow is reachable by anyone you do not fully trust. This flaw has none of the soft preconditions common to AI CVEs: there is no prompt injection, no user click and no special configuration. The default setup is the vulnerable one, and attackers were scanning for it before the CVE record existed.

Langflow instances also tend to hold the keys to everything a flow touches: LLM providers, vector databases, SaaS APIs and cloud credentials.

The narrow exception is a single-user install bound to `127.0.0.1` on a laptop. Patch it anyway; it is not an emergency. The pattern of five exploited bugs in eight months is the larger lesson. Langflow's design puts code execution one authorization check away, so do not expose it to the internet even when patched.

## What to do now

1. Check the version with `pip show langflow` or your container tag. Upgrade with `pip install -U "langflow>=1.10.1"` or pull the 1.10.1+ image.
2. Take it off the public internet. Put it behind a VPN or an authenticating proxy.
3. As extra hardening, set `LANGFLOW_AUTO_LOGIN=false` and configure real superuser credentials. IBM lists no official workaround, so this does not replace upgrading.
4. If it was exposed while vulnerable, assume compromise. Rebuild from a clean image and rotate every credential stored in flows, global variables and the environment.
5. Check for persistence before reconnecting: new accounts, cron entries and unfamiliar processes.

## How to tell if you were hit

In proxy or app logs, look for these patterns from unfamiliar IPs:

- `GET /api/v1/auto_login` followed by `POST /api/v1/validate/code`
- POSTs to `/api/v1/build_public_tmp/` that carry a `data` body (CVE-2026-33017)

On the host, child processes of Langflow's Python process, such as `sh`, `curl` or `wget`, and outbound connections to unknown IPs are strong indicators. Also review provider dashboards for use of the API keys Langflow held.

## Timeline

- Mar 25, 2026: CISA adds CVE-2026-33017 to KEV.
- Jul 2, 2026: IBM bulletin published; Langflow 1.10.1 fixes CVE-2026-9198.
- Jul 6, 2026: Exploitation attempts begin, per KEVIntel telemetry.
- Jul 17, 2026: CVE-2026-9198 record published.
- Aug 4, 2026: CISA adds CVE-2026-9198 to KEV; federal due date Aug 7.

## Sources

1. [IBM — Security Bulletin: Unauthenticated RCE via auto-login bypass and code validation (Langflow OSS)](https://www.ibm.com/support/pages/node/7278927)
2. [CISA — Known Exploited Vulnerabilities catalog (JSON feed, checked 2026-10-21)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
3. [CVE.org — CVE-2026-9198 record](https://www.cve.org/CVERecord?id=CVE-2026-9198)
4. [CVE.org — CVE-2026-33017 record](https://www.cve.org/CVERecord?id=CVE-2026-33017)
5. [The Hacker News — CISA flags Langflow RCE, Tomcat and N-able N-central flaws](https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html)

---
Source page: https://erroneo.us/security/briefs/langflow-cve-2026-9198-kev-unauthenticated-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt