Security Intelligence
Loading table of contents...
At a glance:
-
Langflow OSS, an AI workflow platform that connects applications, data sources, and cloud services, is under active exploitation through a critical vulnerability chain that can provide threat actors with administrative access and remote code execution on affected servers.
-
The vulnerability combines an authentication bypass and a code execution flaw, creating a direct path from network access to server compromise and potential exposure of credentials, application secrets, business data, and connected systems.
-
Organizations running Langflow OSS versions 1.0.0 through 1.10.0 are advised to prioritize internet-facing instances and upgrade to the latest versions.
Threat summary
On August 4, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-9198 to its Known Exploited Vulnerabilities (KEV) catalog, indicating evidence of exploitation in the wild.
The vulnerability affects Langflow OSS, an open-source platform used to build and operate artificial intelligence (AI) workflows that connect large language models, application programming interfaces, databases, and business systems. Specifically, versions 1.0.0 through 1.10.0 are affected, with a fix available in version 1.10.1.
IBM, which publishes security advisories and remediation guidance for Langflow OSS, disclosed the vulnerability on July 2, 2026, assigning it a CVSS score of 9.8. The advisory states that successful exploitation can result in arbitrary command execution on the affected host.
According to a public proof-of-concept (PoC) code published in July 2026, CVE-2026-9198 is an attack chain that combines two vulnerabilities in Langflow OSS:
- CVE-2026-9103 is described as an authentication bypass that allows a threat actor to obtain a SUPERUSER token through the /api/v1/auto_login endpoint.
- CVE-2026-8481 affects the /api/v1/validate/code endpoint and allows user-supplied Python code to execute on the underlying server.
The PoC demonstrates how a threat actor can first exploit CVE-2026-9103 to obtain administrative access within Langflow and then use that access to reach the vulnerable code validation functionality associated with CVE-2026-8481. Code submitted through the validation process executes on the underlying server, allowing the threat actor to run operating system commands using the permissions assigned to the Langflow service account.
A successful compromise can provide access to application secrets, credentials, AI workflows, connected databases, cloud services, and other integrated systems.
Neither IBM nor CISA has identified a specific threat actor or published details regarding observed exploitation campaigns.
Analysis
Since early 2026, multiple Langflow vulnerabilities have enabled remote code execution, several have been added to CISA's KEV catalog, and researchers had documented their rapid weaponization following disclosure. Previous campaigns focused on gaining access to credentials, application secrets, cloud resources, and connected data sources, making internet-accessible Langflow deployments a significant target for threat actors.
Langflow often serves as a connection point between artificial intelligence applications, databases, cloud services, automation platforms, and internal business systems. A compromised Langflow server can therefore provide access to credentials, application secrets, sensitive data, workflows, and connected infrastructure beyond the affected application itself.
For organizations with internet-accessible deployments, the impact can extend well beyond the initial server. A threat actor who gains control of a Langflow instance may gain access to connected systems, cloud resources, and business data. For managed service providers, compromise of a centrally managed platform can increase exposure across multiple customer environments and operational systems.
Mitigations
Organizations running Langflow OSS versions 1.0.0 through 1.10.0 are advised to prioritize internet-facing instances and upgrade to version 1.10.1 or later. Asset inventories, external exposure assessments, and application ownership records can help identify affected systems across enterprise and managed environments.
Those operating affected deployments are advised to limit access to Langflow management interfaces, review activity involving the /api/v1/auto_login and /api/v1/validate/code endpoints, and investigate unexpected administrative activity.
Organizations that identify signs of compromise, or that cannot determine whether exploitation occurred on an exposed system, should rotate credentials, secrets, and API keys associated with the affected Langflow instance, as successful exploitation provides command execution on the underlying server.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
