1. Executive summary
CVE-2026-9198 is a critical (CVSS 9.8) unauthenticated code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-04, confirming active exploitation in the wild. The vulnerability chains two API endpoints on default deployments to grant SUPERUSER tokens to any network caller and subsequently execute arbitrary Python code, resulting in full remote code execution (RCE). EMEA financial services running exposed Langflow instances face immediate risk of system compromise and must treat this as a priority-one remediation.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability permits unauthenticated, automatable RCE on default deployments, indicating a failure of pre-deployment security testing for internet-facing components. | Clients must include Langflow instances in their operational resilience testing programmes and verify exposure. |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Active exploitation is confirmed by CISA KEV; successful compromise of a Langflow server constitutes a major ICT-related incident. | If exploitation is detected on a client system, trigger major-incident reporting to the competent authority per the article's timelines. |
3. Technical analysis & attack chain
CVE-2026-9198 (CWE-94: Improper Control of Generation of Code) permits unauthenticated, remote attackers to achieve full RCE on default IBM Langflow OSS deployments by chaining two vulnerable API endpoints. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Confirmed attack chain
- Initial access / token minting: The attacker sends an unauthenticated request to the
/api/v1/auto_loginendpoint. On default Langflow deployments, this endpoint mints SUPERUSER tokens to any network caller without requiring credentials. - Code execution: Using the SUPERUSER token, the attacker sends a request to the
/api/v1/validate/codeendpoint. This endpoint executes user-supplied code via Python'sexec()function. - System compromise: Arbitrary code execution in the context of the Langflow application yields full control of the host.
Affected versions: IBM Langflow OSS 1.0.0 through 1.10.0.
SSVC assessment: CISA-ADP rates this vulnerability as exploitable ("active"), automatable ("yes"), and with total technical impact, confirming the low-bar threshold for wide-scale exploitation.
Context — related Langflow CVEs in CISA KEV: Two additional Langflow vulnerabilities are already listed in CISA KEV, indicating sustained targeting of the product: CVE-2026-0770 (inclusion of functionality from untrusted control sphere, KEV due date 2026-07-24) and CVE-2026-55255 (authorization bypass through user-controlled key, KEV due date 2026-07-10). Both are single-sourced to CISA KEV entries; verify specific exploitation details before enforcement.
BSI advisories: The German BSI has issued high-severity advisories (WID-SEC-2026-2593 and WID-SEC-2026-2410) for IBM Langflow Desktop and IBM Langflow Desktop OSS, noting code execution, privilege escalation, and security bypass capabilities. The precise version mapping between the Desktop variants and the OSS range (1.0.0–1.10.0) is not confirmed in the source material.
4. Mitigation & containment
P1 — within 24 hours
- Identify and isolate: Locate all Langflow OSS instances (versions 1.0.0–1.10.0). If any are internet-facing, remove them from external exposure immediately by blocking ports 7860 (default Langflow port) and any reverse-proxy routes at the WAF or load balancer.
- Block exploit endpoints: If the service must remain internally accessible, apply WAF or reverse-proxy rules to block unauthenticated requests to
/api/v1/auto_loginand restrict access to/api/v1/validate/codeto authenticated, non-SUPERUSER sessions only. - Hunt for compromise: Query access logs for HTTP requests to
/api/v1/auto_loginand/api/v1/validate/code. Any successful (HTTP 200) responses to/api/v1/auto_loginfrom untrusted IPs should be treated as a potential compromise. Perform forensic triage on matching hosts.
P2 — within 72 hours
- Patch or decommission: Apply the vendor fix per IBM's instructions. If a patched version is not yet available or cannot be deployed, decommission the Langflow instance. CISA's KEV entry sets a due date of 2026-08-07 for federal agencies; EMEA financial services should treat this as the maximum allowable window.
- Disable auto_login: If patching is delayed, disable or restrict the
/api/v1/auto_loginendpoint via configuration or application-level middleware to prevent unauthenticated SUPERUSER token minting.
P3 — within 7 days
- Validate remediation: Confirm all Langflow instances are patched to a fixed version or decommissioned. Re-scan external attack surface to ensure no instances remain exposed.
- Review related CVEs: Ensure remediation also addresses CVE-2026-0770 and CVE-2026-55255, both of which are in CISA KEV and target the same product family.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material. The exploitation is conducted via standard HTTP API requests and does not inherently drop named payloads or establish C2 infrastructure identifiable from the provided sources.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
Unauthenticated HTTP POST/GET request to /api/v1/auto_login returning HTTP 200 with a token |
Web server access logs, WAF logs, reverse proxy logs | High — confirmed attack path |
HTTP POST to /api/v1/validate/code containing Python code payloads |
Web server access logs, WAF logs, application logs | High — confirmed attack path |
| SUPERUSER token usage in subsequent API requests from previously unseen source IPs | Application authentication logs, API gateway logs | Medium — consistent with exploit chain |
6. Detection
Insufficient indicators to author detection rules. The source material provides API endpoint paths and the Python exec() mechanism but no distinctive strings, file artefacts, command-line flags, or registry keys attributable to the exploit payload itself. The behavioural indicators in §5 should be implemented as log-based correlation rules in the SIEM.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-9198 | 9.8 Critical | ⚠ KEV 2026-08-04 | 2% | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to a… |
7. Sources
- NVD, CVE-2026-9198 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-9198, 2026-08-03
- CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-9198, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198, 2026-08-04
- The Hacker News, CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited, https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html, 2026-08-05
- BleepingComputer, CISA orders urgent action on actively exploited Langflow RCE flaw, https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-langflow-rce-flaw/, 2026-08-05
- BSI Germany, WID-SEC-2026-2593 — IBM Langflow Desktop, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2593, 2026
- BSI Germany, WID-SEC-2026-2410 — IBM Langflow Desktop OSS, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2410, 2026
- NVD, CVE-2026-0770 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-0770, 2026
- NVD, CVE-2026-55255 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-55255, 2026
8. Adverse Trace position
CVE-2026-9198 is a maximum-severity (CVSS 9.8, CRITICAL) unauthenticated RCE vulnerability in a product with confirmed active exploitation (CISA KEV, added 2026-08-04). The attack chain is trivially automatable, requires no credentials, and affects default deployments of IBM Langflow OSS 1.0.0–1.10.0. EMEA financial services clients running Langflow — particularly in AI/ML pipeline or internal tooling contexts where the service may be less centrally governed — must immediately inventory, isolate, and patch or decommission affected instances. The presence of two additional Langflow CVEs already in CISA KEV (CVE-2026-0770, CVE-2026-55255) indicates sustained adversary interest in this product. Adverse Trace will monitor for the emergence of public exploit code, IOCs, and attribution details, and will issue an update if exploitation scope expands or reliable detection artefacts become available.
Published via PulseTrace — Adverse Trace threat intelligence.