Langflow RCE (CVE-2026-9198): What Langflow Is, Who Got Hit, and How to Fix It

Quick answer: CVE-2026-9198 is an unauthenticated remote code execution (RCE) vulnerability in IBM Langflow OSS, the popular open-source AI app builder, scored CVSS 9.8 (Critical). An attacker with no login chains two API endpoints — /api/v1/auto_login (which hands a SUPERUSER token to anyone) and /api/v1/validate/code (which runs attacker-supplied Python via exec()) — to fully take over the server. It affects versions 1.0.0 through 1.10.0, is fixed in 1.10.1, and is actively exploited (added to CISA’s KEV catalog on Aug 4, 2026). The exact checks and fix are below.

What is Langflow?

Langflow is an open-source visual builder for AI applications. Think of it as drag-and-drop Lego for AI: you connect blocks — a language model, a data source, a prompt, a tool — on a canvas, and out comes a working chatbot, a retrieval-augmented search, or an autonomous agent. Almost no code required. It grew out of the LangChain ecosystem, is maintained under DataStax, and is now part of IBM after its DataStax acquisition. It’s one of the most-starred AI-workflow tools on GitHub — which is exactly why a flaw in it matters so much.

How it’s used — and where it lives

Teams use Langflow to prototype and ship AI features fast: internal chatbots, customer-support agents, RAG pipelines over private docs. Because it’s a web app, it runs on a server — a laptop for testing, or a cloud instance for real workloads. By default it listens on port 7860. The problem: to share a flow with teammates or wire it into other systems, people routinely expose that port to the open internet — often with Langflow’s convenience "auto-login" default still on. That combination — an internet-facing AI tool that can execute code, with authentication effectively disabled — is the whole story.

What is CVE-2026-9198?

How attackers exploit it

The exploit is a two-step chain, and neither step needs a password:

• Steal a master key. The /api/v1/auto_login endpoint was meant to make local development frictionless — it mints a SUPERUSER token for any caller. Exposed to the network, it hands that token to attackers.
• Run any code. With the SUPERUSER token, the attacker calls /api/v1/validate/code, which executes attacker-supplied Python through exec(). That’s arbitrary code, running as the Langflow process, on the host.

The result is complete server takeover from a single unauthenticated attacker. Public proof-of-concept code already exists, which is why mass scanning started almost immediately.

What happens after the RCE is armed — the documented losses

This isn’t hypothetical. A near-identical Langflow RCE (CVE-2026-33017) was caught being exploited in the wild, and security researchers (Trend Micro, Sysdig) documented exactly what attackers do with this class of flaw — the same pattern we see across exposed AI infrastructure:

• Weaponized within ~20 hours of the advisory — before any public PoC existed. Defenders barely had time to patch.
• Cryptomining. Attackers dropped a Go-based loader ("lambsys") that installed a customized XMRig Monero miner. The victim’s server — and the victim’s cloud bill — was hijacked to mine cryptocurrency for the attacker.
• Secret theft. The malware harvested .env files, database credentials, environment variables, and API keys. Those are the keys to the victim’s other systems — so one exposed Langflow box becomes a foothold into the whole estate.
• Defense evasion. It disabled security controls (AppArmor, SELinux, UFW, iptables) and wiped system logs, so the victim often couldn’t even see what happened.

Who got hit? Exposed AI infrastructure — Langflow servers left reachable from the internet, across multiple cloud providers and regions. CVE-2026-9198 gives attackers the same SUPERUSER code execution, so the same playbook applies.

Am I exposed? How to check

You are at risk if you run Langflow 1.0.0–1.10.0 and it’s reachable from the network — especially the internet — with auto-login enabled. Check the version and exposure directly:

# 1) Version — 1.0.0 through 1.10.0 are vulnerable
curl -s http://<your-langflow-host>:7860/api/v1/version

# 2) Is the auto-login bypass reachable without credentials? (test a host you own)
#    A token returned here means auto-login is on and you are exploitable.
curl -s -X POST http://<your-langflow-host>:7860/api/v1/auto_login

# 3) Is port 7860 exposed to the internet? Search Shodan/Censys for your IPs + "Langflow".

Then hunt for compromise indicators: unexplained high CPU (a hidden miner), unknown processes (xmrig, lambsys), disabled firewall/AppArmor/SELinux, missing or truncated logs, and outbound connections to mining pools.

How to fix it

There is no safe configuration that leaves a vulnerable, internet-facing Langflow reachable — you must upgrade and reduce exposure.

# pip
pip install --upgrade "langflow>=1.10.1"

# Docker — confirm the tag maps to >= 1.10.1
docker pull langflowai/langflow:latest

# Require real auth instead of the dev auto-login default
export LANGFLOW_AUTO_LOGIN=false
# ...then configure a real superuser (LANGFLOW_SUPERUSER / _PASSWORD)

• Take it off the open internet. Bind Langflow to localhost and reach it over a VPN, or put it behind an authenticating reverse proxy with an allow-list. Never expose port 7860 directly.
• If you were exposed, assume breach. Rotate every secret the host could see — database passwords, cloud keys, and especially LLM/API keys — then hunt for the cryptominer and rebuild the host if you find compromise.

What if you can’t patch immediately?

Get it off the internet now — a firewall rule or killing the public port buys you time in seconds, because remote exploitation depends on network reachability. Then upgrade. Do not leave a vulnerable Langflow reachable "just for a day"; near-identical flaws were weaponized in under a day.

How CATAAM turns this into a monitored control

The hard part at scale isn’t one Langflow box — it’s knowing every AI tool you’ve quietly exposed. That’s what attack surface management does: continuously discover what’s reachable from the internet, so an exposed, code-executing AI service surfaces as a finding instead of a surprise cryptominer. Start with a free external attack-surface scan to see what’s already reachable.

CATAAM’s discipline is turning a headline CVE into a specific control obligation and riding your continuous control monitoring: for SOC 2, an exposed RCE on an in-scope host is a CC6 (boundary) and CC7 (vulnerability management) concern, evidenced by the patch. It’s the same rapid-response pattern as the Cisco Secure Firewall VPN flaw and the Oracle EBS zero-day. And to stop the secret-theft half of this attack, Prompt Guard keeps credentials and API keys from leaking in the first place.

AI tools are powerful. An open door is still an open door — make sure yours is locked, patched, and watched.

Frequently asked questions

What is CVE-2026-9198?

CVE-2026-9198 is an unauthenticated remote code execution flaw (CVSS 9.8) in IBM Langflow OSS 1.0.0–1.10.0. Attackers chain /api/v1/auto_login (which mints a SUPERUSER token to anyone) and /api/v1/validate/code (which runs Python via exec()) to take over the server. It is fixed in 1.10.1.

Is CVE-2026-9198 being exploited?

Yes — public exploit code is circulating and CISA added it to the Known Exploited Vulnerabilities catalog on Aug 4, 2026, with hundreds of exploitation attempts observed from attackers across dozens of countries.

What do attackers do after they exploit Langflow?

Based on the near-identical CVE-2026-33017 campaign documented by Trend Micro and Sysdig: install an XMRig Monero cryptominer (hijacking your compute and cloud bill), steal .env files, database credentials and API keys, disable security controls, and wipe logs — often within about 20 hours of disclosure.

Am I affected by CVE-2026-9198?

If you run Langflow 1.0.0–1.10.0 and it’s reachable from the network (especially the internet on port 7860) with auto-login enabled, yes. Check the version with "curl http://<host>:7860/api/v1/version" and whether the port is exposed.

How do I fix CVE-2026-9198?

Upgrade to Langflow 1.10.1 or newer, take it off the open internet (VPN or authenticating proxy), disable the auto-login default and require real authentication, and — if you were exposed — rotate every secret and API key and hunt for a cryptominer.