IBM Langflow bug can let attackers run host commands

Published August 4, 2026 CVE-2026-9198

A flaw in IBM Langflow OSS lets remote attackers run host commands without logging in. CISA says attackers have already exploited it.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Fixed in 1.10.1Fix recorded on Aug 26, 2026
Affected versions
1.0.0 through 1.10.0
Weakness
CWE-94Code Injection
Exploit likelihood
61% in 30 daysEPSS, higher than 99% of known flaws
Affects
Langflow OSS
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 4, 2026
Federal fix deadline
Aug 7, 2026

How it works

  • An attacker contacts the exposed auto-login service without signing in.
  • It wrongly issues a token with the highest Langflow privileges.
  • The attacker then submits Python code to the network-accessible code-checking service.
  • Langflow runs that code on the host, allowing arbitrary command execution.

What to do

Run python3 -m pip show langflow in each Python environment hosting Langflow. A Version from 1.0.0 through 1.10.0 is affected. This package check alone does not prove network exposure or compromise.

Run this in the application environment you want to check:

python3 -m pip show langflow

Upgrade every affected Langflow OSS installation to version 1.10.1. IBM provides no workaround. Confirm the deployed service now runs 1.10.1.

Technical details

CVE-2026-9198 chains /api/v1/auto_login, which issues SUPERUSER tokens to network callers, with /api/v1/validate/code, which executes submitted Python through exec. No login or user interaction is required on affected default deployments. IBM rates the flaw 9.8 critical. CISA added it to the Known Exploited Vulnerabilities catalog, confirming real-world exploitation without providing public attack details.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source