CVE-2026-9198: IBM Langflow Auto-Login + Code-Validation Chain to Unauthenticated RCE (KEV)

CVE-2026-9198 chains two IBM Langflow OSS flaws — an unauthenticated auto-login endpoint that mints superuser tokens for any caller, and a code-validation endpoint that runs arbitrary Python via 'exec()' — into full, unauthenticated remote code execution on default Langflow deployments, and CISA added it to KEV within days of disclosure because of active exploitation against internet-facing AI-agent-builder instances.

CVE-2026-9198 is a code injection vulnerability (CWE-94) in IBM Langflow, an open-source visual builder for AI and LLM agent workflows. NVD's description states: "IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments" (NVD).

NVD lists the record as Analyzed, but the only CVSS metric on file is IBM's own Secondary rating: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high confidentiality, integrity and availability impact. No NVD Primary score has been published, so the 9.8 shown here is IBM's own CNA rating, not an NVD-confirmed figure (NVD).

IBM's security bulletin for this CVE confirms the affected range as Langflow OSS 1.0.0 through 1.10.0 and the fixed release as 1.10.1, and IBM "strongly recommends upgrading Langflow OSS to version 1.10.1"; no workaround is documented. The bulletin was published 02 July 2026, shortly before the CVE record itself went live on NVD (IBM Security Bulletin).

CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-04, with a required-action due date of 2026-08-07 — a three-day window reserved for the most urgent active-exploitation cases — describing it as a flaw that "allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments," and lists known ransomware campaign use as "Unknown." CISA's structured decision record (SSVC) marks exploitation as "active," the flaw as "automatable," and its technical impact as "total" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.2866 (98th percentile), reflecting substantial scanning and exploitation activity against internet-reachable Langflow instances (FIRST EPSS).

Because both endpoints in the chain require zero authentication and the combination works against a Langflow instance's default configuration, any internet-facing Langflow OSS deployment on 1.0.0 through 1.10.0 — common among teams prototyping internal AI agents and tool-calling pipelines — should be upgraded to 1.10.1 immediately, and any instance that was ever reachable from the internet before patching should be treated as potentially already compromised, since CISA and FIRST both describe this as a fully automatable, unauthenticated RCE chain.

• IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default deployments. — NVD
• NVD vulnStatus is Analyzed; the only CVSS metric is IBM's own Secondary CVSS v3.1 score of 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD Primary score published. — NVD
• Affected Langflow OSS 1.0.0 through 1.10.0, fixed in 1.10.1; IBM recommends upgrading to 1.10.1; no workaround documented; bulletin published 02 July 2026. — IBM Security Bulletin
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-04, required-action due date 2026-08-07, ransomware campaign use listed as Unknown; CISA SSVC record marks exploitation active, automatable, technical impact total. — CISA KEV
• EPSS score is 0.2866 (98th percentile) as of 2026-10-28. — FIRST EPSS