CVE-2026-9202: Langflow Auth Bypass Vulnerability

CVE-2026-9202 Overview

CVE-2026-9202 is a critical authentication flaw affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability allows unauthenticated attackers to create unlimited user accounts on any exposed Langflow instance. When operators set the documented NEW_USER_IS_ACTIVE=true deployment option, attacker-created accounts activate immediately and can authenticate against protected endpoints. This bypass grants access to Remote Code Execution (RCE) endpoints without requiring the AUTO_LOGIN configuration. The flaw maps to Missing Authentication for Critical Function [CWE-306] and carries a CVSS score of 9.8.

Critical Impact
Remote unauthenticated attackers can register active accounts on Langflow instances and reach RCE endpoints, resulting in full compromise of the affected host.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.0
Langflow deployments configured with NEW_USER_IS_ACTIVE=true
Publicly accessible Langflow instances without upstream authentication

Discovery Timeline

2026-07-17 - CVE-2026-9202 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-9202

Vulnerability Analysis

Langflow is a low-code framework for building applications backed by large language models. The affected versions expose a user registration endpoint that does not require authentication before creating accounts. An attacker sends registration requests directly to the API and generates arbitrary quantities of user records without rate limiting or administrator approval.

The severity depends on the NEW_USER_IS_ACTIVE environment variable. When set to true, Langflow marks newly created accounts as active without email verification or administrator review. Active accounts can immediately authenticate and obtain session tokens. Those tokens grant access to component and flow execution endpoints that support arbitrary Python code evaluation, enabling Remote Code Execution on the Langflow host.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306] on the user creation endpoint. The registration route treats unauthenticated account creation as a supported self-service feature. Combined with the NEW_USER_IS_ACTIVE=true deployment option, this design removes the administrator approval step that would otherwise gate account activation. The flaw is an authentication bypass rather than a coding error in a specific function.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker identifies a reachable Langflow instance, issues an HTTP request to the registration endpoint with attacker-chosen credentials, and receives an active account. The attacker then logs in through the standard authentication endpoint, receives a session token, and posts a component or flow containing Python code to the execution API. The Langflow worker evaluates the code, yielding shell access as the Langflow process user.

No public exploit code is listed in the NVD entry. Refer to the IBM Support advisory for vendor guidance on the exposed endpoints and configuration flags.

Detection Methods for CVE-2026-9202

Indicators of Compromise

Unexpected user records in the Langflow database, especially with sequential or randomized usernames.
HTTP POST requests to the Langflow user registration endpoint from external IP addresses with no prior session cookies.
Successful authentication events immediately following account creation from the same source IP.
Flow or component execution requests containing Python os.system, subprocess, or socket calls.

Detection Strategies

Inspect Langflow application logs for account creation events that lack a prior administrator session.
Correlate registration, login, and code execution API calls originating from the same client within short time windows.
Alert on outbound network connections from Langflow worker processes to unfamiliar destinations.
Monitor Langflow container or host processes for child processes spawned from the Python interpreter, such as sh, bash, or curl.

Monitoring Recommendations

Forward Langflow reverse proxy and application logs to a SIEM for centralized query and alerting.
Baseline normal registration and login volumes so brute registration campaigns generate anomaly alerts.
Track changes to environment variables NEW_USER_IS_ACTIVE and AUTO_LOGIN across deployments.
Enable audit logging for all flow execution requests and retain payload metadata for review.

How to Mitigate CVE-2026-9202

Immediate Actions Required

Upgrade Langflow to a fixed release above 1.10.0 as directed by the IBM Support advisory.
Set NEW_USER_IS_ACTIVE=false on all Langflow deployments until upgrade is complete.
Confirm AUTO_LOGIN=false and require administrator approval for every new account.
Restrict network exposure of Langflow instances to trusted networks or VPN clients only.

Patch Information

IBM published remediation guidance at the IBM Support Page. Administrators should apply the vendor-recommended Langflow release and review deployment manifests, Helm charts, and Docker Compose files to ensure the fixed version pins the container image tag. Rotate any credentials or API keys stored inside Langflow flows after upgrading, since existing attacker accounts may have accessed them.

Workarounds

Place Langflow behind an authenticating reverse proxy that enforces single sign-on before requests reach the application.
Block the public registration endpoint at the proxy or web application firewall until the patch is deployed.
Audit and delete unrecognized user accounts, then rotate secrets referenced by existing flows.
Disable inbound internet access to Langflow and require access through a bastion host or private network.

bash

# Configuration example: disable active-by-default registration
export NEW_USER_IS_ACTIVE=false
export AUTO_LOGIN=false
export LANGFLOW_SUPERUSER=admin
export LANGFLOW_SUPERUSER_PASSWORD='<strong-random-password>'

# Restart the Langflow service after applying the environment changes
systemctl restart langflow