Langflow CVE-2026-9198: Unauthenticated RCE in Your AI Agent Control Plane

The machine that orchestrates your AI agents is now a pre-authentication shell for anyone who can reach it over the network. On 4 August 2026, CISA added CVE-2026-9198 — an unauthenticated remote-code-execution flaw in IBM's Langflow — to its Known Exploited Vulnerabilities catalog. Two facts make this one worth stopping for. First, it is a full RCE on a default deployment, no credentials required, CVSS 9.8. Second, the exploitation telemetry shows attacks beginning on 6 July 2026 — eleven days before the vendor even published the advisory. This bug was hit as a zero-day before there was anything to patch, and KEVIntel sensors recorded a fresh exploitation attempt as recently as today.

Langflow is a visual builder for LLM and agent pipelines. That is precisely why an unauthenticated RCE here is not one more web app falling over — it is the control plane for an organisation's entire agent fleet handed to a stranger.

The two-request chain that turns Langflow into a shell

The vulnerability, classed as CWE-94 (code injection), is not a subtle memory-corruption gadget. It is a logic chain of two REST calls that were never meant to be reachable together by an anonymous caller:

1. POST /api/v1/auto_login — this endpoint was intended as a local-development convenience that mints a SUPERUSER session. It is not bound to loopback and it does not enforce authentication, so it will hand a SUPERUSER token to any network caller.
2. POST /api/v1/validate/code — with that token in hand, this endpoint runs attacker-supplied Python through exec() on the underlying host.

That is the whole exploit. No heap grooming, no ROP chain, no memory leak to defeat ASLR. An attacker who can open a TCP socket to the Langflow port gets a SUPERUSER token from the first request and arbitrary code execution from the second. The CVSS vector — AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H — reads the way it does because every dimension is worst-case: network reachable, low complexity, no privileges, no user interaction.

"Is the box exposed to the internet?" is the wrong first question. The right one is: "Can anything an attacker already controls — a compromised workstation, a rogue container, a pivoted host — reach TCP on the Langflow service?" For a default install the answer is usually yes, and that is all the exploit needs.

Public proof-of-concept code has been available since 21 July 2026, and a Nuclei detection template landed on 29 July. By the time CISA listed it, this was point-and-click.

Why an unauthenticated RCE in Langflow is worse than the average web RCE

A generic RCE gives an attacker one application server. An RCE in Langflow gives them the credential vault for everything downstream of it. Consider what a Langflow instance actually holds in memory and on disk:

• Model-provider API keys — OpenAI, Anthropic, Azure, self-hosted inference endpoints. Stored so flows can call them.
• Tool credentials — the tokens each agent uses to reach Slack, GitHub, internal APIs, ticketing systems.
• Database connection strings — the flows that do retrieval need read (and often write) access to production data stores.
• Broad egress — an agent orchestrator is designed to make outbound calls to arbitrary services, so the network policy around it is usually permissive.

An attacker with exec() on this host does not need to escalate anywhere. They read the flow configurations, harvest every secret, and inherit the network position of a service that was built to talk to everything. This is the entry vector that agentic ransomware families weaponise once they are inside — the same class of platform we wrote about in the JADEPUFFER analysis. CVE-2026-9198 is how they get the initial foothold in the first place.

The exploitation timeline: hit as a zero-day, patched second

The dates matter here more than usual, because they show a defensive model failing in a specific way. Per KEVIntel and The Hacker News:

Date	Event
2026-05-21	CVE-2026-9198 reserved
2026-07-06	First exploitation observed in the wild
2026-07-17	IBM publishes the advisory and ships the fix
2026-07-21	Public proof-of-concept released
2026-07-29	Nuclei scanner template released
2026-08-04	Added to CISA KEV
2026-08-13	Exploitation attempts still being observed

Read the first two rows together. Attacks began eleven days before the vendor advisory existed. For those eleven days there was no CVE to match against, no patch to apply, and no signature to load — and yet the traffic was already there: 650 exploitation attempts from 244 unique IP addresses across 41 countries by the time The Hacker News reported the KEV listing, and KEVIntel telemetry has since climbed to 762 attempts from 298 IPs across 42 countries and 159 distinct user-agents as of 13 August. This was not a targeted operation against one victim; it was broad, opportunistic internet-scale scanning that found a class of target — internet-facing agent builders — and hosed it.

Any defence that waits for a CVE number, a vendor patch, or an IOC feed was structurally blind for that window. The requests themselves were the only evidence, and they were on the wire the whole time.

Remediation

Treat any internet-reachable Langflow instance older than 1.10.1 as compromised until proven otherwise. Exploitation predates the patch, so "we upgraded promptly" is not the same as "we were never hit."

1. Am I affected?

Versions 1.0.0 through 1.10.0 are vulnerable. Check the installed version and whether the vulnerable endpoints answer:

# Installed version
pip show langflow | grep -i version
# or, for a container image
docker inspect <image> --format '{{index .Config.Labels "org.opencontainers.image.version"}}'

# Does auto_login hand a token to an anonymous caller? (run from a non-loopback host)
curl -s -X POST http://<host>:7860/api/v1/auto_login | grep -o 'access_token'

If auto_login returns an access_token to a remote, unauthenticated request, the instance is exploitable right now. Prioritise anything internet-facing, then anything reachable from user subnets or CI/CD networks.

2. Patch — exact fixed version

Upgrade to Langflow 1.10.1 or later, the first release that fixes CVE-2026-9198. Versions 1.0.0 through 1.10.0 are affected; 1.10.1 is the fixed baseline confirmed by both the NVD record and IBM's July advisory.

pip install --upgrade "langflow>=1.10.1"
# containerised
docker pull langflowai/langflow:1.10.1

3. Can't patch now? Compensating controls

• Put it behind authentication. Front the instance with an authenticating reverse proxy or VPN so /api/v1/auto_login is never reachable by an unauthenticated caller.
• Block the two endpoints at the proxy. If you cannot upgrade immediately, deny POST /api/v1/auto_login and POST /api/v1/validate/code at the WAF/proxy layer for all external sources.
• Remove internet exposure. An agent-builder UI has no business being publicly listed. Bind it to an internal interface.
• Segment the egress. Constrain outbound traffic from the Langflow host so a popped instance cannot reach cloud metadata endpoints (169.254.169.254), internal databases, or lateral targets. This limits blast radius even after exec().

4. Hunt for compromise

Because exploitation ran before any advisory, log review — not signature matching — is the reliable detector. Map the activity to MITRE ATT&CK:

• T1190 — Exploit Public-Facing Application. Search access logs for POST /api/v1/auto_login and POST /api/v1/validate/code, especially from external or unexpected source IPs. Successful 2xx responses on auto_login from non-loopback callers are the strongest single signal. The Nuclei template published 29 July codifies the request shape.
• T1059.006 — Command and Scripting Interpreter: Python. Look for anomalous child processes spawned by the Langflow worker: shells (/bin/sh, bash), curl/wget, package managers, or interpreters that a normal flow never launches.
• T1552 / T1528 — Unsecured Credentials / Steal Application Access Token. Any read of flow configuration files or the secrets store immediately after a validate/code call is credential theft in progress.
• T1071 / T1496 — Application-Layer C2 / Resource Hijacking. Outbound connections to never-before-seen ASNs, or new sustained CPU load consistent with cryptomining, following an exec on the host.

The 298-IP set is opportunistic and rotates, so do not build detection solely around a static IP blocklist — prioritise the behaviour (anonymous SUPERUSER mint → code execution → outbound) over any single indicator.

5. Eradicate and verify

Patching closes the door; it does not un-leak what already left. If you find any successful exploitation — or cannot prove you were not exploited during the pre-patch window — then:

• Rotate every secret the instance could reach. Every model-provider API key, every tool token, every database credential referenced by any stored flow. The RCE gave the attacker read access to all of them; the patch does not rotate them for you.
• Rebuild, don't clean. Redeploy the host or container from a known-good image rather than attempting to remove an implant in place.
• Confirm clean after patching. Re-run the auto_login probe from a remote host and confirm it now refuses the anonymous caller, then re-check process and egress baselines for 72 hours.

Catching the wave, not the write-up

The uncomfortable lesson of this CVE is the eleven-day gap between first exploitation and first advisory. During that window, the only artefact that existed was the traffic itself — the anonymous auto_login call, the validate/code payload, the outbound beacon that followed. This is the exact blind spot Zero Hunt's AI Traffic Analysis was built to close: a proprietary deep-learning model with four parallel inference heads (suspicious traffic, malware classification, attack-type identification, application fingerprinting), trained on billions of PCAP sequences, running locally on the appliance GPU at 2.7+ Gbit/s. It flags the anomalous session — a never-before-seen source minting a privileged token, then a host that historically only ingests suddenly beaconing to an unknown ASN — while it is happening, not in the next morning's SIEM digest and not conditional on a CVE number existing yet.

The other half is not waiting to be told a bug exists. Zero Hunt's 10-agent generative engine writes a fresh exploit chain per target — its own auto_login-to-validate/code proof against your actual instance — validated in the AI Gym against a corpus of 142+ self-evolving skills before it ever runs in production, with every finding ECDSA-signed for the audit trail. Continuous, change-triggered campaigns mean a newly exposed Langflow instance on your perimeter is tested within the hour it appears, not at the next annual pentest. The choice this CVE forces is between finding your own unauthenticated RCE before 298 strangers do, and reading about it in a KEV entry eleven days late. Talk to us about which side of that eleven-day gap you want to be on.