IBM Langflow Code Injection Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-04) — this is being exploited in the wild.
  • Fixed in 1.10.1 — upgrade to this release or later.
  • CVEs: CVE-2026-9198.

What it is

CVE-2026-9198 is a code injection vulnerability in IBM Langflow OSS, affecting versions 1.0.0 through 1.10.0. It arises from chaining two API endpoints. The first, /api/v1/auto_login, issues SUPERUSER authentication tokens to any caller on the network, with no credentials required. The second, /api/v1/validate/code, passes user-supplied input to exec().

An attacker who can reach these endpoints over the network first calls /api/v1/auto_login to obtain a superuser token, then presents that token to /api/v1/validate/code to run arbitrary code on the host. No authentication, no user interaction, and no prior access are required — this is a fully unauthenticated, remote path to code execution on default Langflow deployments.

The CVSS score is 9.8 (Critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity and availability. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 2026-08-04, meaning it is known to be exploited.

What to do

  • Upgrade Langflow OSS to version 1.10.1, which fixes this issue. Versions 1.0.0 through 1.10.0 are affected.
  • If immediate upgrade isn’t possible, restrict network access to the Langflow API so /api/v1/auto_login and /api/v1/validate/code are not reachable from untrusted networks — this includes the internet and, ideally, any general internal network segment.
  • Check whether your Langflow deployment is running with default settings that expose these endpoints without additional authentication in front of them (e.g. via a reverse proxy or API gateway), and add authentication controls at that layer if the application itself cannot be patched immediately.
  • Given the CISA KEV listing, treat this as a priority patching action rather than routine maintenance, and check logs for calls to /api/v1/auto_login or /api/v1/validate/code from unexpected sources.

For leadership 🧭

Executive summary. Any unauthenticated caller who can reach a default Langflow OSS deployment can obtain superuser access and run arbitrary code on the host, and this is already being exploited in the wild per its CISA KEV listing. Given the critical severity and confirmed exploitation, this needs upgrading or network isolation today, not at the next scheduled maintenance window.

Why it matters:

  • The /api/v1/auto_login endpoint hands out SUPERUSER tokens to any network caller with no credentials, removing the authentication barrier entirely for versions 1.0.0 through 1.10.0.
  • That token can immediately be used against /api/v1/validate/code, which runs supplied input through exec(), giving full remote code execution on the host running Langflow.
  • CISA added this to its Known Exploited Vulnerabilities catalogue on 2026-08-04, meaning attackers are actively using this exact chain rather than it being theoretical.
  • Because no user interaction or prior access is needed, exposure exists wherever the Langflow API is reachable, including internal networks, not just internet-facing instances.

Now / Next / Later:

  • Now: Check whether any Langflow OSS instance is reachable on the network and block access to /api/v1/auto_login and /api/v1/validate/code from untrusted sources immediately.
  • Next: Upgrade Langflow OSS to version 1.10.1 during the next available change window, and review logs for prior calls to these two endpoints from unexpected sources.
  • Later: Put authentication or access control at a reverse proxy or API gateway in front of Langflow so that default-open endpoints like these are never exposed directly to the network again.

Source