Loading story…
A public proof-of-concept exploit has been released for CVE-2026-9198, a critical remote code execution flaw in Langflow OSS that affects versions 1.0.0 through 1.10.0 under default configurations exposing auto-login and code-validation endpoints. According to CSIRT Italia, attackers can chain two weaknesses to obtain SUPERUSER privileges and execute arbitrary code on vulnerable instances. The issue has been patched by the vendor, and organizations running exposed Langflow deployments have been urged to update immediately.
Additional reporting points to exploit-development and testing activity tied to Langflow, including references to artifacts such as langflowpoc.py and langflowtargets.txt, alongside infrastructure consistent with staging or proof-of-concept validation. While that material does not confirm victim compromise or attribute activity to a specific threat actor, it indicates that exploit code and targeting resources are circulating publicly, increasing the risk to internet-exposed Langflow systems, including deployments embedded in enterprise AI workflow environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A public proof-of-concept exploit was made available for CVE-2026-9198 in Langflow OSS. The disclosure highlighted exploitation conditions involving exposed auto-login and code-validation endpoints and advised users to update according to the vendor bulletin.
The vendor had already patched CVE-2026-9198, a critical remote code execution vulnerability affecting Langflow OSS versions 1.0.0 through 1.10.0 under default exposed settings. The issue could allow attackers to chain flaws to obtain SUPERUSER access and execute arbitrary code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-9198** allows unauthenticated remote code execution against default-configured **Langflow OSS** deployments by chaining two exposed API behaviors. According to IBM's security bulletin, the `/api/v1/auto_login` endpoint can issue **SUPERUSER** bearer tokens to any network caller, and the `/api/v1/validate/code` endpoint then executes attacker-controlled Python through `exec()`. IBM said the validator can trigger execution through Python decorators, default arguments, and annotations at function definition time, giving attackers arbitrary command execution on the host. The issue affects Langflow OSS versions **1.0.0 through 1.10.0**, carries a **CVSS 3.1 score of 9.8**, and has no listed workaround. A draft **Metasploit Framework** pull request adds an exploit module for the flaw and says successful exploitation can yield a **Meterpreter** session on vulnerable systems. The module author reported testing against **Langflow 1.8.4 on Ubuntu 22.04**, describing the attack as unauthenticated and effective on default deployments. The pull request also links the bug to **CISA KEV**, underscoring active operational relevance, while IBM advises organizations to upgrade to **Langflow OSS 1.10.1** to remediate the exposure.
Aug 5, 2026
Threat actors rapidly exploited **CVE-2026-33017**, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed `exec()` path with a single crafted request. The bug affects Langflow versions prior to **1.9.0** and stems from the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from **CVE-2025-3248** because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication. Sysdig and other researchers reported exploitation beginning within about **20 hours** of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as `.env`, `.db`, and `/etc/passwd`, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including `173.212.205[.]251:8443`. The severity prompted **CISA** to add the flaw to its **Known Exploited Vulnerabilities** catalog and order federal agencies to remediate by **April 8, 2026** or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to **Langflow 1.9.0 or later**, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.
Jul 2, 2026
IBM disclosed multiple severe vulnerabilities in **Langflow OSS** affecting versions `1.0.0` through `1.10.1`, including remote code execution, denial of service, path traversal, unauthorized file and vector store access, build job information disclosure, and exposed credentials through unauthenticated or insufficiently authorized API endpoints. The most prominent issue, **`CVE-2026-13446`**, is a hard-coded credentials flaw classified as **CWE-798** and scored **CVSS 9.8**, creating a network-exploitable path to compromise confidentiality, integrity, and availability. According to IBM's bulletin, the vulnerable endpoints could let attackers execute code, read arbitrary files, access secrets, modify other users' data, and cancel active builds without proper authorization. IBM advised users to upgrade Langflow OSS to **`1.10.2`** to remediate the issues, as the affected releases expose both application internals and connected external components to critical compromise.
Jul 18, 2026