Langflow CVE-2026-9198: Unauth RCE Actively Exploited

CISA just added another Langflow remote code execution to its Known Exploited Vulnerabilities catalog. CVE-2026-9198 carries a CVSS score of 9.8 and requires zero credentials — two HTTP requests to any internet-facing Langflow instance running versions 1.0.0 through 1.10.0 and an attacker owns the host. Public proof-of-concept code is circulating. Exploitation is confirmed. Federal agencies have until August 7 to patch. If you run Langflow, that deadline is yours too.

How the Attack Works

The exploit chains two endpoints present in every default Langflow install.

First, an attacker hits /api/v1/auto_login. This endpoint was designed for local developer environments where re-typing a password adds friction. On default configurations, it has no check for whether the caller is actually on localhost. Any network caller gets back a SUPERUSER bearer token.

Second, the attacker uses that token to send attacker-controlled Python to /api/v1/validate/code. This endpoint validates flow code in the Langflow visual builder — it passes the code to Python’s exec() with no sandbox. With a superuser token in hand, the endpoint will execute anything: read files, plant backdoors, establish persistence, or exfiltrate every API key and LLM credential stored in your flows.

Two requests. No credentials. Full host compromise. A public proof-of-concept has been available since mid-July.

This Is the Third Time

CVE-2026-9198 is not an aberration. It is a pattern.

• CVE-2025-3248: Unauthenticated RCE via /api/v1/validate/code. CVSS 9.8. Added to CISA KEV in May 2025. Actively exploited by the Flodrix botnet.
• CVE-2026-33017: Unauthenticated RCE via the public flow build endpoint. CVSS 9.3. Exploited within 20 hours of disclosure. CISA’s first AI agent platform in its KEV catalog. Attackers used it to mine Monero.
• CVE-2026-9198: The validate/code endpoint again — this time with a new bypass through auto_login. Same root cause, new entry point.

JFrog found that the patch for CVE-2026-33017 was itself still exploitable. The underlying architectural problem — user-supplied input reaching exec() through endpoints that lack proper exposure controls — has not been resolved. It keeps resurfacing in different entry points. Three CVSS 9.x unauthenticated RCEs in 14 months is not bad luck. It is an engineering debt problem at the architecture level.

Who Is Exposed

Langflow has over 150,000 GitHub stars and ships as a PyPI package, Docker image, Helm chart, and desktop app. DataStax shut down its hosted Langflow service in April 2026, which means the vast majority of active deployments are now self-hosted. IBM owns the project through its DataStax acquisition, but self-hosters are responsible for their own patches.

Every instance running 1.0.0 through 1.10.0 that is reachable from the internet — directly or through a misconfigured reverse proxy — is vulnerable right now.

What to Do

The fix is version 1.10.1. The current release is 1.11.2. Upgrade immediately.

# PyPI
pip install --upgrade langflow

# Docker
docker pull langflowai/langflow:latest
docker-compose down && docker-compose up -d

If you cannot upgrade right now, according to the CISA advisory:

1. Take the instance offline or block all inbound internet access to it.
2. Put it behind a VPN or an authenticating reverse proxy. Block /api/v1/auto_login and /api/v1/validate/code at the proxy layer.
3. Rotate every API key, model provider credential, and secret stored in your Langflow flows. Treat them as compromised.
4. Audit the host: check crontab -l, ~/.ssh/authorized_keys, and recent outbound connections for signs of prior exploitation.

Read the full IBM security bulletin for complete technical details.

The Bigger Picture

Langflow was built as a rapid prototyping tool. The auto_login endpoint made perfect sense for a developer spinning up a local instance. The problem is that local-only convenience features and internet-facing production deployments ended up in the same binary with the same defaults.

AI pipeline tooling is repeating the mistakes web frameworks made twenty years ago: prototype-grade security shipped to production at scale. Flowise is shutting down at the end of August. Langflow has been in CISA’s KEV three times in 14 months. If your AI agent infrastructure depends on tools like these, the security posture conversation cannot wait.

Upgrade. Isolate. Rotate your secrets. Then have the longer conversation about what production-grade AI pipeline security actually requires.