CVE-2026-9198: Langflow auto_login and code validation chain enables unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with a 9.8 CVSS, KEV listing and very high EPSS probability makes this an urgent patch-first item.

What it is

IBM Langflow OSS 1.0.0 through 1.10.0 exposes /api/v1/auto_login, which mints SUPERUSER tokens to any network caller, and /api/v1/validate/code, which runs submitted code through exec(). Chaining the two lets an unauthenticated remote attacker execute arbitrary code on default deployments, and the flaw is listed in CISA KEV with a 9.8 CVSS.

Impact

An attacker gains full remote code execution with SUPERUSER privileges, leading to complete compromise of confidentiality, integrity and availability of the Langflow host and any data or credentials it can reach.

Attack surface

Reachable over the network via the Langflow HTTP API with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed or internally reachable default deployment is a candidate target.

Exploitation

CVE-2026-9198 is in CISA KEV with a due date of 2026-08-07, indicating known exploitation, and EPSS gives a 30-day probability of 0.60597 (99.1st percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor fix from the IBM advisory for Langflow 1.0.0 through 1.10.0, or upgrade past the affected range if a fixed release exists.
• If patching is not immediately possible, remove Langflow from network exposure and restrict API access to trusted hosts only.
• Disable or block /api/v1/auto_login and /api/v1/validate/code at the reverse proxy or WAF until the patch is applied.
• Rotate any credentials, tokens and secrets accessible to Langflow instances, since SUPERUSER token minting may have been abused.
• Follow CISA BOD 26-04 guidance, including the forensics triage requirements, for any affected asset.

Detection

• Search Langflow and proxy logs for requests to /api/v1/auto_login followed by /api/v1/validate/code from the same source.
• Alert on SUPERUSER token issuance to unauthenticated or unexpected clients.
• Monitor for unexpected child processes spawned by the Langflow service, especially shells or interpreters.
• Review outbound connections from Langflow hosts for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.