CVE-2026-9198: Langflow RCE Vulnerability

CVE-2026-9198 Overview

CVE-2026-9198 is a critical unauthenticated remote code execution vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. Attackers can chain two API endpoints to gain full control of default Langflow deployments. The /api/v1/auto_login endpoint mints SUPERUSER tokens for any network caller without authentication. The /api/v1/validate/code endpoint then executes attacker-supplied Python via exec(). The flaw is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Unauthenticated network attackers can chain two Langflow API endpoints to execute arbitrary Python code as SUPERUSER, resulting in full host compromise.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.0
Langflow default deployments exposing the REST API
Self-hosted Langflow instances reachable over the network

Discovery Timeline

2026-07-17 - CVE-2026-9198 published to the National Vulnerability Database
2026-07-24 - Last updated in the NVD database

Technical Details for CVE-2026-9198

Vulnerability Analysis

Langflow is an open-source framework for building LLM-driven agent workflows. The vulnerability combines a broken authentication default with a dangerous code evaluation endpoint. Together, these primitives permit unauthenticated Remote Code Execution (RCE) against exposed instances.

The /api/v1/auto_login route was designed to streamline local development by issuing a SUPERUSER session token automatically. In default deployments, this behavior is not gated by network origin, single-user mode, or an explicit configuration flag. Any caller that can reach the HTTP listener receives a fully privileged token.

With that token, the attacker calls /api/v1/validate/code, an endpoint that accepts Python source and passes it to the built-in exec() function to validate component code. Because exec() runs the submitted code in the Langflow server process, the attacker gains arbitrary code execution under the service account.

Root Cause

The root cause is insecure default configuration combined with unsafe use of dynamic code evaluation. The auto_login endpoint fails to enforce authentication or bind to loopback. The validate/code endpoint trusts authenticated input and evaluates it with exec() rather than parsing it in a sandboxed AST-only mode.

Attack Vector

Exploitation requires only network reachability to the Langflow HTTP API. An attacker issues a GET or POST to /api/v1/auto_login to obtain a SUPERUSER JWT. The attacker then POSTs a JSON payload containing Python source to /api/v1/validate/code, causing the interpreter to execute the payload in-process. No user interaction, prior credentials, or client-side steps are required. See the IBM Support Page for vendor guidance.

Detection Methods for CVE-2026-9198

Indicators of Compromise

Unexpected HTTP requests to /api/v1/auto_login from external or non-developer source addresses.
POST requests to /api/v1/validate/code containing import os, subprocess, socket, or base64-encoded Python payloads.
Child processes spawned by the Langflow Python interpreter such as sh, bash, curl, wget, or python -c.
Outbound network connections initiated by the Langflow process to unknown hosts shortly after validate/code traffic.

Detection Strategies

Inspect reverse-proxy and application logs for sequential access to auto_login followed by validate/code from the same client IP.
Alert on any successful /api/v1/auto_login response returning a SUPERUSER token to a non-allowlisted network.
Monitor Langflow process telemetry for spawned shells, filesystem writes to /tmp, or new listening sockets.

Monitoring Recommendations

Enable verbose FastAPI access logging and forward events to a centralized log platform for correlation.
Baseline normal Langflow API usage patterns and alert on deviation, especially anonymous access to authentication endpoints.
Track EPSS movement for CVE-2026-9198 (currently 0.437%) alongside exposure scans of internet-facing Langflow assets.

How to Mitigate CVE-2026-9198

Immediate Actions Required

Upgrade Langflow to a fixed release above 1.10.0 as identified in the IBM Support Page.
Remove Langflow instances from direct internet exposure and place them behind an authenticating reverse proxy or VPN.
Rotate any secrets, API keys, and model provider credentials stored in Langflow flows on affected hosts.
Audit hosts for signs of prior exploitation, including new cron entries, SSH keys, and outbound connections.

Patch Information

IBM has published remediation guidance on the vendor advisory. Administrators should apply the fixed Langflow OSS build referenced in the IBM Support Page and redeploy containers using the updated image. Verify that /api/v1/auto_login no longer issues tokens to unauthenticated callers after the upgrade.

Workarounds

Block /api/v1/auto_login and /api/v1/validate/code at the reverse proxy for all non-trusted source networks.
Set LANGFLOW_AUTO_LOGIN=false and configure explicit LANGFLOW_SUPERUSER credentials before restarting the service.
Bind the Langflow listener to 127.0.0.1 and require an authenticating gateway for remote access.
Run Langflow as a non-privileged user inside a container with egress filtering to limit post-exploitation impact.

bash

# Configuration example: disable auto-login and require explicit credentials
export LANGFLOW_AUTO_LOGIN=false
export LANGFLOW_SUPERUSER="admin"
export LANGFLOW_SUPERUSER_PASSWORD="<strong-random-secret>"
export LANGFLOW_NEW_USER_IS_ACTIVE=false

# Restrict the listener to loopback and front with an authenticating proxy
langflow run --host 127.0.0.1 --port 7860