{"id":"CVE-2026-9198","kind":"vulnerability","aliases":["CVE-2026-9198"],"related":[],"title":"IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER…","description":"Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"IBM Langflow, an AI workflow builder, has a code injection flaw that lets unauthenticated attackers run arbitrary code on the server. The CISA KEV catalog lists it as actively exploited, and the description says default deployments are affected.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-08-04T00:00:00+00:00","products":[{"name":"IBM Langflow","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"langflow","fixed":["1.10.1"],"affected":">= 1.0.0, < 1.10.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-agents","ai-tooling","exploited","langflow","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Identify every Langflow instance, including internal and test ones, and check its version against the fix from IBM.","fix":"Upgrade Langflow to the version IBM lists as fixed; if no fix is available, follow the mitigations in IBM's advisory or take the instance offline.\nRotate any credentials and API keys that Langflow instances could read, then review hosts for signs of compromise per CISA's forensics triage requirements.","status":"open","published_at":"2026-07-17T18:17:17+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:32:02+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T20:32:02Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Langflow to the version IBM lists as fixed; if no fix is available, follow the mitigations in IBM's advisory or take the instance offline.\nRotate any credentials and API keys that Langflow instances could read, then review hosts for signs of compromise per CISA's forensics triage requirements.","summary":"IBM Langflow, an AI workflow builder, has a code injection flaw that lets unauthenticated attackers run arbitrary code on the server. The CISA KEV catalog lists it as actively exploited, and the description says default deployments are affected.","category":"ai-tooling","who_cares":["langflow","self-hosted","ai-agents"],"confidence":0.8,"analyst_note":"Affected and fixed versions are unknown from the KEV entry; find the IBM advisory for CVE-2026-9198 and record the version range and default-config details.","how_to_check":"Identify every Langflow instance, including internal and test ones, and check its version against the fix from IBM.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000409,"input_tokens":2180,"output_tokens":382,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':110C,136C,167C '-2026':16A,19A '-9198':17A,20A '/api/v1/auto_login':12A '1.0.0':4A '1.10.0':6A '26':109C,135C,166C 'accord':99C 'achiev':84C 'action':95C 'activ':63B 'adher':163C 'affect':72B 'agent':26B 'ai':25B,28B,38B 'ai-ag':24B 'ai-tool':27B 'allow':7A,80C 'appli':96C 'applic':133C 'arbitrari':51B 'asset':157C 'attack':9A,49B,82C 'base':114C 'bod':108C,134C,165C 'builder':40B 'catalog':59B 'chain':11A 'cisa':57B,93C,106C,123C 'cloud':139C 'code':43B,52B,76C,87C 'complianc':104C 'contain':74C 'cve':15A,18A 'default':69B,90C 'deploy':70B,92C 'descript':67B 'discontinu':142C 'ensur':103C,162C 'evalu':155C 'execut':88C 'exploit':30B,64B 'exposur':160C 'flaw':45B 'follow':132C 'forens':125C 'full':85C 'guidanc':121C,137C 'guidelin':169C 'host':34B 'ibm':1A,21A,35B 'inject':44B,77C 'instruct':102C 'internet':159C 'kev':58B 'langflow':2A,22A,23A,31B,36B,73C,91C 'let':47B 'list':60B 'mint':13A 'mitig':97C,148C 'note':120C,131C 'oss':3A 'patch':168C 'priorit':111C 'product':146C 'remot':86C 'requir':94C,127C 'respons':153C 'risk':116C 'run':50B 'say':68B 'secur':112C 'see':117C,128C 'self':33B 'self-host':32B 'server':55B 'servic':140C 'stakehold':151C 'superus':14A 'tool':29B 'triag':126C 'unauthent':8A,48B,81C 'unavail':150C 'updat':113C 'url':118C,129C 'use':143C 'vendor':101C 'vulner':78C 'workflow':39B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-17T18:17:17+00:00","kev":{"dateAdded":"2026-08-04","dueDate":"2026-08-07","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-9198","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9198","severity":null,"published_at":"2026-08-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9198","severity":null,"published_at":"2026-07-17T18:17:17+00:00","modified_at":"2026-08-17T20:16:48+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}