## https://sploitus.com/exploit?id=B0B587A7-09F3-5DBA-ACDE-DF3AECC56FB5
# CVE-2026-9198 - IBM Langflow OSS Unauthenticated Remote Code Execution (RCE)
[](https://nvd.nist.gov/vuln/detail/CVE-2026-9198)
[](https://nvd.nist.gov/vuln/detail/CVE-2026-9198)
[](https://cwe.mitre.org/data/definitions/94.html)
> Critical unauthenticated remote code execution vulnerability affecting IBM Langflow OSS.
The vulnerability results from chaining two weaknesses:
1. `/api/v1/auto_login` can issue a privileged `SUPERUSER` bearer token to an unauthenticated network caller.
2. `/api/v1/validate/code` processes attacker-controlled Python code in an unsafe execution context.
When chained, these weaknesses can result in arbitrary Python code execution with the privileges of the Langflow backend process.
The vulnerability has a **CVSS v3.1 score of 9.8 (Critical)** and is classified as **CWE-94 — Improper Control of Generation of Code**.
## Affected Versions
| Product | Vulnerable Versions | Fixed Version |
| ---------------- | ------------------- | ------------- |
| IBM Langflow OSS | 1.0.0 – 1.10.0 | 1.10.1 |
IBM recommends upgrading to **Langflow OSS 1.10.1**.
## Severity
**CVSS:** 9.8 Critical
```text
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```
| Metric | Value |
| ------------------- | --------- |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
| Scope | Unchanged |
## Vulnerability Chain
```text
Unauthenticated attacker
|
v
/api/v1/auto_login
|
| SUPERUSER bearer token
v
/api/v1/validate/code
|
| Unsafe Python evaluation
v
Remote Code Execution
|
v
Langflow backend process
```
The important security issue is not simply that either endpoint exists. The impact comes from the combination of an authentication bypass/token issuance primitive with an unsafe code-validation mechanism.
## Security Impact
Successful exploitation can provide an attacker with code execution in the security context of the Langflow backend.
Depending on the deployment, this may expose:
* Application secrets
* Environment variables
* API credentials
* Files accessible to the Langflow process
* Internal network resources
* Connected AI/LLM services
* Databases and vector stores
* Other services reachable from the host
The practical impact therefore depends heavily on the privileges and network access available to the Langflow process.
## Safe HTTP Fingerprinting
The following requests are intended for **non-destructive identification** and do not contain a code-execution payload.
### Check the Langflow service
```http
GET / HTTP/1.1
Host: TARGET
Accept: */*
Connection: close
```
### Inspect API metadata
```http
GET /docs HTTP/1.1
Host: TARGET
Accept: text/html,*/*
Connection: close
```
### Check the auto-login route without supplying an execution payload
```http
GET /api/v1/auto_login HTTP/1.1
Host: TARGET
Accept: application/json
Connection: close
```
For defensive testing, record the status code, headers, and response structure rather than attempting to use any returned credential material.
### Detection-oriented request
A useful defensive telemetry pattern is:
```text
/api/v1/auto_login
followed shortly by
/api/v1/validate/code
```
A source making these requests without the normal Langflow frontend traffic around them is particularly worth investigating.
## What Not To Do in Production
Do **not** test the vulnerability by submitting arbitrary Python to `/api/v1/validate/code` against a production instance.
A safe validation workflow is:
```text
1. Identify the Langflow version
2. Confirm whether it is <= 1.10.0
3. Review access logs for the affected endpoints
4. Check for unexpected SUPERUSER token issuance
5. Check process/application logs for suspicious Python execution
6. Upgrade to 1.10.1
7. Rotate potentially exposed credentials
8. Investigate the host if exploitation is suspected
```
## Detection
Monitor for:
```text
POST /api/v1/validate/code
GET /api/v1/auto_login
POST /api/v1/auto_login
```
Particularly suspicious behavior includes:
* Unauthenticated requests to `/api/v1/auto_login`
* `200 OK` responses containing an `access_token`
* An `auto_login` request immediately followed by `/api/v1/validate/code`
* Requests originating from unexpected external addresses
* Non-browser user agents
* Python/code-related error messages in Langflow responses
* Unexpected child processes spawned by the Langflow service
## Remediation
Upgrade Langflow OSS to:
```text
1.10.1 or later
```
IBM specifically recommends upgrading to 1.10.1.
If exploitation is suspected, patching alone should not be considered sufficient. Review logs and host telemetry and rotate secrets that may have been accessible to the Langflow process.
## Disclosure / Status
* **CVE:** CVE-2026-9198
* **CWE:** CWE-94
* **Severity:** Critical
* **CVSS:** 9.8
* **Affected:** Langflow OSS 1.0.0–1.10.0
* **Fixed:** 1.10.1
* **CISA KEV:** Yes
* **Exploitation:** Reported as active
CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4, 2026.
## References
* NVD: CVE-2026-9198
* IBM Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
* GitHub Advisory: GHSA-5wm9-vgmg-cjv6
* CISA Known Exploited Vulnerabilities Catalog
## Disclaimer
This repository is intended for authorized security research, vulnerability analysis, detection engineering, and controlled laboratory environments.