By CISA added Langflow to its Known Exploited Vulnerabilities catalog on August 4. CVE-2026-9198 gives unauthenticated attackers full remote code execution against Langflow OSS 1.0.0 through 1.10.0 — CVSS 9.8, exploited across 41 countries, with public proof-of-concept code on GitHub. If your Langflow instance touches the internet and you haven’t upgraded to 1.10.1, assume every credential it holds has been seen. The federal patch deadline was August 7. You’re already late.
Two API Calls. That’s the Whole Exploit.
CVE-2026-9198 chains two unauthenticated endpoints that were never supposed to survive development:
Step one: POST /api/v1/auto_login. This endpoint exists to make local development frictionless — it hands out a SUPERUSER JWT to any caller without requiring credentials. In production, where Langflow is often exposed directly, it hands that same token to anyone on the internet.
Step two: POST /api/v1/validate/code. Langflow’s custom component system lets users supply Python code. Rather than parsing it with the AST module, the endpoint evaluates it with exec(). With a superuser token, attacker-controlled Python executes inside the Langflow server process.
That’s it. No credentials needed. No special knowledge. IBM rated it CVSS 9.8, multiple public PoC repositories are now on GitHub, and Langflow shipped this on default settings.
Your AI Pipeline Is a Credential Vault
The reason CVE-2026-9198 is worse than a typical RCE: Langflow is, by design, a hub for every credential your AI workflows need. A compromised instance exposes far more than the server it runs on.
Active campaigns have demonstrated the blast radius. The KeyHunter operation — a NATS-powered botnet tied to earlier Langflow CVEs — dumps the process environment and extracts AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY directly. Stolen keys then run cloud reconnaissance: S3 bucket enumeration, EC2 listing, IAM permission checks. LLM API credentials stored in flows — OpenAI, Anthropic, Gemini — go the same way. One compromised Langflow instance is a master key for your AI infrastructure.
CISA’s telemetry counted 650 exploitation attempts against CVE-2026-9198 from 244 unique IP addresses across 41 countries, starting July 6. Censys found roughly 7,000 Langflow instances exposed to the internet. Public PoCs lower the skill floor to near zero.
The Seventh Exploited Langflow CVE in Twelve Months
CVE-2026-9198 is not a surprise. Langflow has had at least seven distinct vulnerabilities reach active exploitation since 2025 — CVE-2025-3248 (JadePuffer ransomware), CVE-2026-33017 (AWS key theft, incomplete fix), CVE-2026-5027 (path traversal RCE), and CVE-2026-55255 (IDOR credential theft), among others. The pattern isn’t one bad commit. It’s a framework built to move fast on developer experience that hasn’t caught up on security fundamentals.
The broader AI orchestration ecosystem inherited the same shortcuts — dev-only endpoints, exec()-based code evaluation, auto-login defaults — because these tools were designed to get you from prototype to working demo in an afternoon, not to sit exposed on port 7860. VentureBeat noted after CVE-2026-33017: “LangGraph and LangChain have the same holes.” This is an ecosystem problem, not just a Langflow one.
Fix It Now: Five Steps
- Upgrade to Langflow 1.10.1. The patch removes the unsafe
exec()path from the validation endpoint and enforces authentication on superuser commands. This is the only complete fix. - Set
LANGFLOW_AUTO_LOGIN=falseif you cannot upgrade immediately. This disables the unauthenticated token endpoint. It is a workaround, not a fix. - Remove Langflow from direct internet exposure. Place it behind a VPN or an authenticating reverse proxy. No Langflow port should be reachable without credentials at the network layer.
- Rotate every credential it touched. Treat any internet-exposed instance running 1.0.0–1.10.0 as fully compromised: revoke and reissue AWS access keys, LLM API keys, database credentials, and any secrets stored in environment variables or flows.
- Audit for prior compromise. Check for new cron jobs, unfamiliar SSH authorized keys, unexpected outbound connections, and IAM permission changes on linked cloud accounts. Evidence of breach makes this an incident, not just a patch.
AI orchestration frameworks are credential aggregators. A vulnerability in one is a vulnerability in everything it connects. The security bar for Langflow, Ollama, Gradio, and similar tools needs to match what they have access to — which, in most production deployments, is everything.
