Public PoC Released for Critical Langflow RCE Enabling SUPERUSER Access

A public proof-of-concept exploit has been released for CVE-2026-9198, a critical remote code execution flaw in Langflow OSS that affects versions 1.0.0 through 1.10.0 under default configurations exposing auto-login and code-validation endpoints. According to CSIRT Italia, attackers can chain two weaknesses to obtain SUPERUSER privileges and execute arbitrary code on vulnerable instances. The issue has been patched by the vendor, and organizations running exposed Langflow deployments have been urged to update immediately.

Additional reporting points to exploit-development and testing activity tied to Langflow, including references to artifacts such as langflowpoc.py and langflowtargets.txt, alongside infrastructure consistent with staging or proof-of-concept validation. While that material does not confirm victim compromise or attribute activity to a specific threat actor, it indicates that exploit code and targeting resources are circulating publicly, increasing the risk to internet-exposed Langflow systems, including deployments embedded in enterprise AI workflow environments.