CVE-2026-9198 Gives Unauthenticated RCE in IBM Langflow OSS Agent Control Planes

IBM Langflow open source versions 1.0.0 through 1.10.0 contain a remote code execution chain scored CVSS 9.8 under CVE-2026-9198. The flaw is not a subtle logic bug in a prompt template. It is an authentication boundary failure on an internet-reachable control plane: /api/v1/auto_login hands any caller a SUPERUSER token, and /api/v1/validate/code runs attacker-supplied Python through exec().

Langflow sits in a category of software that crept onto perimeter risk registers quietly. Teams deploy it to wire together LLM workflows, tool connectors, and agent graphs. It looks like developer infrastructure. Operationally it behaves like a remote administration console with credentials to every API key stored in the project — because that is what an agent control plane is.

IBM fixed the issue in Langflow 1.10.1. Administrators should also set LANGFLOW_AUTO_LOGIN=false on any deployment that does not explicitly require the feature. CISA added CVE-2026-9198 to the KEV catalog on 4 August 2026, with a federal remediation deadline of 7 August under BOD 26-04. Proof-of-concept code followed about a week after disclosure. If your Langflow instance was on the public internet through late July and early August, the question is no longer whether to patch — it is whether someone already walked the chain.

How the Chain Bypasses Authentication

Langflow exposes a REST API for building and running flows. Two endpoints combine into the observed exploit path:

• /api/v1/auto_login — Intended as a development convenience, this route issues a session for the SUPERUSER role without validating caller identity. On an instance bound to 0.0.0.0 or published through a reverse proxy without additional auth, any internet client can request a token.
• /api/v1/validate/code — Accepts Python source for validation and executes it in the server process. With a SUPERUSER token, the caller can submit arbitrary code and receive execution in the Langflow application context.

The chain is short enough to script in a few HTTP requests. That matters for detection: you are not looking for a multi-stage malware dropper. You are looking for two API paths called in sequence from an address that has no business talking to your agent platform.

Langflow Has Form on Auth Boundaries

CVE-2026-9198 is not the first time Langflow's API surface treated "logged in" as a binary switch without asking who logged in. Prior advisories in the same product line documented missing authentication on administrative routes and unsafe defaults that left development features enabled in production-shaped deployments.

The pattern should inform prioritisation. A CVSS 9.8 in a niche OSS project might lose queue position against a higher-profile vendor flaw — until you map where Langflow runs. If it holds production API keys for CRM, ticketing, code repositories, or internal search, the blast radius matches a CI/CD secret store compromise even though the asset inventory lists it under "AI tooling."

Treat internet-exposed Langflow the way you treat an internet-exposed TeamCity or VPN appliance: restrict network access, disable convenience endpoints, and assume the instance stores credentials worth stealing.

What Attackers Gain After RCE

Remote code execution on Langflow is not an end state. It is a starting point for:

• Reading environment variables and configuration files that hold LLM provider keys, OAuth client secrets, and connector credentials.
• Modifying flows to exfiltrate prompts, responses, or attached documents passing through the platform.
• Using the host as egress for secondary tooling — scanning internal networks from a host that may sit in a developer VLAN with broader reach than a typical web tier.
• Planting persistence in flow definitions or startup hooks that survive a container restart until someone inspects the graph, not just the container image tag.

Agent platforms aggregate trust. Compromising one instance often yields keys that work elsewhere, which is why CISA's three-day federal deadline is shorter than many KEV entries receive.

CISA KEV and the BOD 26-04 Clock

KEV inclusion on 4 August with remediation due 7 August signals that CISA treats unauthenticated RCE on widely deployed OSS agent infrastructure as an immediate risk, not a scheduled maintenance item. Federal agencies must patch or mitigate within the BOD window; private-sector teams should read that as exploitation pressure rather than as someone else's timeline.

Mitigation before upgrade includes:

• Upgrade to Langflow 1.10.1 or later on every on-premises or self-hosted instance.
• Set LANGFLOW_AUTO_LOGIN=false even on upgraded builds unless a documented workflow requires otherwise.
• Remove public ingress — if developers need access, put Langflow behind your SSO-protected VPN or zero-trust access layer rather than a direct DNS record.
• Rotate every secret Langflow can read after any confirmed or suspected exploitation, starting with LLM and SaaS connector keys.

Detection and Hunting Signals

Concrete log patterns to work from:

• Unauthenticated or newly authenticated requests to /api/v1/auto_login from non-corporate IP ranges, especially if volume spikes after PoC publication.
• Sequential calls to /api/v1/validate/code with large or obfuscated POST bodies shortly after an auto_login session is created.
• New or modified flow JSON containing unexpected HTTP nodes, shell invocations, or outbound connections to unfamiliar hosts.
• Process execution anomalies on the Langflow host — python child processes spawned by the application server outside known deployment windows.
• Outbound connections from the Langflow container or VM to paste sites, VPS providers, or Tor-adjacent hosting shortly after the API sequence above.

Shodan and similar internet scan data are useful for discovery — many organisations learn they run Langflow from an external scan before they learn it from an asset inventory. Internal discovery should include container registries and Kubernetes namespaces labelled for experimentation; those environments often inherit production-adjacent network paths.

Enriching Source Addresses From Langflow Logs

Once you have candidate source IP addresses from auto_login attempts, enrichment separates your own penetration testers from internet-wide exploit spray.

• Run external hits through IP reputation lookups to check hosting context, prior scanning behaviour, and association with known exploit activity.
• For callbacks or domains embedded in malicious flow modifications, use domain intelligence and DNS history.
• Batch the full set via bulk lookups when reviewing weeks of access logs — Langflow deployments on public IPs accumulate probe traffic quickly after KEV listing.
• Feed results into your SIEM through the API so the next Langflow alert carries the same context automatically.
• Track CVE-2026-9198 in CVE Watch alongside EPSS movement for reprioritisation against other KEV entries in the same patch cycle.

If you recover scripts or dropped binaries from the Langflow host, file hash lookups help determine whether the payload matches a public PoC or a customised follow-on kit.

Network Posture for Agent Control Planes

The broader lesson from CVE-2026-9198 is architectural. LLM agent platforms, workflow orchestrators, and "internal only" automation UIs are joining VPN concentrators and remote management interfaces on the list of assets that must never sit on a public IP without an additional authentication layer.

Minimum posture:

• Default deny ingress to Langflow ports at the firewall; allow only from administrative networks.
• Disable auto-login and other developer defaults in production configuration management, not in ad hoc environment variables someone set during a hackathon.
• Monitor egress from Langflow hosts with the same attention you give build servers — both hold secrets and both reach internal APIs.
• Include agent platforms in vulnerability management scope even when the security team did not deploy them; shadow AI projects are shadow IT with API keys attached.

If enrichment confirms exploitation, run incident response assuming credential theft until rotated keys prove otherwise. The validate/code endpoint gives an attacker interactive Python on the host; treat any secret the process could read as burned.

Langflow 1.10.1 closes the chain. It does not answer whether someone already used SUPERUSER access to copy your connector credentials in July. Patch, disable auto_login, hunt the logs, enrich the hits — in that order, without waiting for the next maintenance window to treat an agent control plane like the perimeter asset it has become.