CVE-2026-9198
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- Record
CVE-2026-9198- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2026-45236
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- Record
EUVD-2026-45236- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5wm9-vgmg-cjv6
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1...
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- Record
GHSA-5wm9-vgmg-cjv6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CISA KEV No score
IBM Langflow Code Injection Vulnerability
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
- Record
CVE-2026-9198- Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- Record
CVE-2026-9198- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- Record
CVE-2026-9198- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Langflow AI auto_login RCE | 2026-07-17 |
| PoC in GitHub | 0xdak/CVE-2026-9198_exploit | 2026-07-21 |
| PoC in GitHub | 0xgh057r3c0n/CVE-2026-9198 | 2026-07-24 |
| PoC in GitHub | ywh-jfellus/CVE-2026-9198 | 2026-07-24 |
| PoC in GitHub | rmhowe425/PoC-CVE-2026-9198 | 2026-08-05 |
| PoC in GitHub | Procjevt/CVE-2026-9198 | 2026-08-10 |
| PoC in GitHub | CuteeCat/CVE-2026-9198 | 2026-08-11 |
| PoC in GitHub | chessalekin/cve-2026-9198_exploit | 2026-08-23 |
| PoC in GitHub | joaovicdev/EXPLOIT-CVE-2026-9198 | 2026-08-29 |
| Exploit-DB | Langflow 1.10.0 - RCE | 2026-09-02 |
| PoC in GitHub | Riftweld/langflow-cve-2026-9198 | 2026-10-12 |
| Nuclei | IBM Langflow - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-9198 is a critical vulnerability (CVSS 9.8) in Ibm Langflow, published July 17, 2026. CISA lists it as known to be exploited, since August 4, 2026. EUVD reports exploitation since August 4, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 28.7%, the 98th percentile. No source names a fixed version.