Exploit for CVE-2026-9198 CVE-2026-9103 CVE-2026-9198

kitploit · 2026-08-28

Description

Unauthenticated RCE in IBM Langflow OSS via auto-login bypass and code injection endpoint.

Entry point

Parametercode · request body

Path/api/v1/validate/code

Code injection vulnerability allowing arbitrary Python execution via validate/code endpoint.

Affected Langflow versions

Langflow< 1.10.1

All known vulnerabilities by product

CVSS Score

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

34.7%higher than 98.4% of all CVEs

Updated 2026-08-30

CVE Information

Exploit Details

Modified:2026-08-28 16:13

Last Seen:2026-08-28 17:39

Reporter:KitPloit

Tags

IBM Langflow OSSUnauthenticated RCEAuto-login bypassCode injectionPython execution

Other exploits for the same CVE

EXPLOIT-CVE-2026-9198

2026-08-30 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

Exploit for Code Injection in Langflow

2026-08-29 joaovicdevGITHUB

CVE-2026-9198_exploit

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

PoC-CVE-2026-9198

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

Exploit Code

MARKDOWN17 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-0XGH057R3C0N-CVE-2026-9198
![Logo Langflow](https://assets.kitploit.com/production/public/readmes/42655/938ea7c659cbdc3a25654f6e500e1fbd08cb9ed010b6034b8cdd7b2f17c3891a.png)

# 🚨 CVE-2026-9198

## IBM Langflow OSS RCE non autenticata tramite bypass del login automatico

![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg) ![Python 3.6+](https://img.shields.io/badge/python-3.6+-blue.svg) ![Security](https://img.shields.io/badge/security-CVE--2026--9198-red.svg)

* * *

## 📋 Panoramica

**CVE-2026-9198** è una vulnerabilità critica di Remote Code Execution (RCE) non autenticata in IBM Langflow OSS. Questo exploit combina due vulnerabilità:

  * **CVE-2026-9103** : Bypass del login automatico che concede token JWT di superutente a chiamanti non autenticati
  * **CVE-2026-8481** : Iniezione di codice nell'endpoint `/api/v1/validate/code` che consente l'esecuzione arbitraria di codice Python