---
id: "CVE-2026-9198"
kind: "vulnerability"
aliases: ["CVE-2026-9198"]
title: "IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "IBM Langflow", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "langflow", "fixed": ["1.10.1"], "affected": ">= 1.0.0, < 1.10.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ai-agents", "ai-tooling", "exploited", "langflow", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-07-17T18:17:17+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9198", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9198", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER…

IBM Langflow, an AI workflow builder, has a code injection flaw that lets unauthenticated attackers run arbitrary code on the server. The CISA KEV catalog lists it as actively exploited, and the description says default deployments are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Langflow affected ? fixed ?
- vendor:langflow affected >= 1.0.0, < 1.10.1 fixed 1.10.1

## How to check

Identify every Langflow instance, including internal and test ones, and check its version against the fix from IBM.

## Fix

Upgrade Langflow to the version IBM lists as fixed; if no fix is available, follow the mitigations in IBM's advisory or take the instance offline.
Rotate any credentials and API keys that Langflow instances could read, then review hosts for signs of compromise per CISA's forensics triage requirements.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9198
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9198

## From the sources

Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_