CVE-2026-9198: Langflow's CVSS 9.8 RCE Is Already Being Exploited

When businesses rush to bolt AI capabilities onto their web apps, they often reach for something like Langflow: a drag-and-drop workflow builder for chaining large language models, document retrievers, and external APIs. Fast to deploy, visually approachable, and increasingly popular for building internal chatbots and AI agents. Also, as of August 4, confirmed as actively exploited in the wild — CVSS 9.8, zero authentication required, and a CISA patch deadline of August 7.

CVE-2026-9198 is a code injection vulnerability (CWE-94) affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. CISA added it to the Known Exploited Vulnerabilities catalog on August 4 alongside two other actively weaponized flaws, all carrying the same August 7 remediation deadline under Binding Operational Directive 26-04. The combination of a trivial two-request exploit chain, public proof-of-concept code circulating since late July, and a default-on attack surface makes this one worth moving on immediately.

The Exploit Is Two API Calls Away

No credentials required. No special configuration needed. On a default Langflow deployment, an attacker chains two HTTP requests to compromise the host:

• Step 1 — GET /api/v1/auto_login: Langflow's built-in convenience endpoint returns a superuser bearer token with no credentials required whatsoever. Enabled by default.
• Step 2 — POST /api/v1/validate/code: Armed with the superuser token, the attacker submits an arbitrary Python payload. Langflow evaluates it with exec() — full Python code execution at the privilege level of the Langflow process.

The result is host-level code execution: read files, exfiltrate credentials, establish persistence, pivot laterally to internal systems. IBM has identified no workaround. Upgrading to Langflow OSS 1.10.1 is the only remediation available.

Why the Default Configuration Is the Real Problem

The auto_login endpoint exists to make local development convenient — no credentials to juggle while you're prototyping on a laptop. The problem is that it ships enabled by default, and a large number of Langflow instances end up on internet-accessible servers with that setting untouched. Developers spin up a demo, the port gets exposed, and what was a local dev shortcut becomes an unauthenticated superuser handshake for anyone who finds the server.

This is a recurring pattern with AI tooling: frameworks optimize for developer experience first, default security posture is permissive, and the assumption of a local-network deployment never quite makes it into the production checklist. Multiple fully functional proof-of-concept exploits have been circulating since late July with step-by-step instructions. This is not a theoretical risk.

The Other Two CVEs on CISA's August 7 List

The Langflow flaw shares its deadline with two additional entries confirmed as actively exploited in the wild:

• CVE-2026-34486 (Apache Tomcat, CVSS 7.5) — A bypass of the patch for CVE-2026-29146, allowing circumvention of Tomcat's EncryptInterceptor when cluster mode is active. Affected versions: 9.0.116, 10.1.53, and 11.0.20. If you run Java app servers in a Tomcat cluster, check your version and patch accordingly.
• CVE-2026-18556 (N-able N-central, CVSS 8.2) — A second authentication bypass in the MSP remote monitoring platform (distinct from CVE-2026-18577 disclosed earlier this week). Remediation requires upgrading to version 2026.3.1.7 or later, and CISA recommends reviewing Take Control session logs for anomalous activity and checking for Cloudflare Tunnel abuse as a persistence mechanism.

AI Tooling Is Now a Real Attack Surface

Langflow is not an isolated case. The same arc — AI infrastructure deployed quickly, default configuration left intact, port inadvertently exposed — has played out with LLM serving frameworks, vector databases, and AI agent orchestrators across the industry. Traditional vulnerability management programs are tuned for known enterprise software and often miss tools that went from a GitHub star to a production server in an afternoon. If your team has deployed any AI workflow builder, LLM proxy, or model-serving endpoint, now is a good time to audit what's listening on which ports and whether any auto-authentication shortcuts remain enabled.

What to Do Right Now

• Langflow: Upgrade to version 1.10.1 immediately. Verify that auto_login is disabled or that the Langflow port is not reachable from the public internet. Rotate any secrets, API keys, or database credentials the instance had access to if you cannot rule out prior exploitation.
• Apache Tomcat: Check for versions 9.0.116, 10.1.53, or 11.0.20 in clustered deployments and apply current patches. Treat unpatched clustered instances as potentially compromised.
• N-able N-central: Confirm you are on 2026.3.1.7 or later and review remote session logs for anomalous activity from late July onward.
• General AI tooling: Apply the same firewall hygiene to AI workflow builders and LLM servers that you would to any public-facing API — no internet exposure without authentication, and ideally VPN or private-network access only.

Federal civilian agencies have until August 7 under BOD 26-04. For everyone else, the practical deadline is identical — proof-of-concept code is already public, and scanning tools running it do not check your agency status first.

This is precisely the kind of threat — a novel vector in tooling that barely existed two years ago — where 24x7x365 NOC monitoring earns its keep, catching anomalous outbound connections from an AI service before an attacker has time to establish a foothold.