Langflow Auto-Login and Code Validation Flaws Enable Unauthenticated RCE
Active Exploitation · 6 sources · Updated 3mo ago · First seen Aug 5, 2026
A critical vulnerability tracked as CVE-2026-9198 allows unauthenticated remote code execution against default-configured Langflow OSS deployments by chaining two exposed API behaviors. According to IBM's security bulletin, the /api/v1/auto_login endpoint can issue SUPERUSER bearer tokens to any network caller, and the /api/v1/validate/code endpoint then executes attacker-controlled Python through exec(). IBM said the validator can trigger execution through Python decorators, default arguments, and annotations at function definition time, giving attackers arbitrary command execution on the host. The issue affects Langflow OSS versions 1.0.0 through 1.10.0, carries a CVSS 3.1 score of 9.8, and has no listed workaround.
A draft Metasploit Framework pull request adds an exploit module for the flaw and says successful exploitation can yield a Meterpreter session on vulnerable systems. The module author reported testing against Langflow 1.8.4 on Ubuntu 22.04, describing the attack as unauthenticated and effective on default deployments. The pull request also links the bug to CISA KEV, underscoring active operational relevance, while IBM advises organizations to upgrade to Langflow OSS 1.10.1 to remediate the exposure.
