← Back to feed
2026-08-10 Malicious Tool TLP:CLEAR

Langflow CVE-2026-9198 Under Active Exploitation Through Default Auto-Login and Code Validation

Date: 2026-08-10
Tags: malicious-tool

Executive Summary

CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities catalog on 2026-08-04 after identifying evidence of active exploitation. The Register reported that unauthenticated attackers can chain default Langflow auto-login behavior with an exposed code-validation function to execute Python remotely on Langflow OSS 1.0.0 through 1.10.0; defenders should upgrade to 1.10.1 or later and remove direct internet access to administration and code-execution functions.

Campaign Summary

FieldDetail
Campaign / MalwareActive exploitation of Langflow CVE-2026-9198; CISA and The Register named no malware
Actor / AttributionUnknown; CISA and The Register did not name a threat actor (confidence: none)
TargetInternet-accessible Langflow OSS 1.0.0 through 1.10.0 deployments, particularly default configurations (The Register citing IBM)
VectorUnauthenticated remote code execution by chaining auto-login token issuance with code validation that executes supplied Python (The Register citing IBM)
StatusActive; CISA confirmed exploitation and The Register reported a fixed version is available
First ObservedCVE publication 2026-07-17; CISA KEV addition 2026-08-04 (The Register; CISA)

Detailed Findings

Exploit Chain

The Register reported, citing IBM, that CVE-2026-9198 combines two behaviors present in default Langflow deployments. According to The Register, the auto-login function can mint a superuser token for an unauthenticated network caller, and the code-validation function can execute supplied Python after the caller obtains that token. The Register reported that chaining those behaviors provides unauthenticated remote code execution against a vulnerable default deployment.

Affected Versions and Remediation

The Register reported, citing IBM, that Langflow OSS versions 1.0.0 through 1.10.0 are affected and that operators should upgrade to version 1.10.1 or later. The Register reported that the CVE was published on 2026-07-17 and that version 1.11.2 was the latest PyPI release when its article was published on 2026-08-05.

CISA added CVE-2026-9198 to its KEV catalog on 2026-08-04 based on evidence of active exploitation. CISA's catalog entry directs affected organizations to apply vendor mitigations, follow applicable federal guidance for cloud services, or discontinue use when mitigations are unavailable.

Scope and Attribution

The Register reported that the extent of exploitation was unknown as of 2026-08-05. CISA and The Register did not identify an exploiting actor, malware family, attacker infrastructure, payload hash, or other campaign IOC.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190CISA confirmed active exploitation, and The Register reported unauthenticated exploitation of exposed default Langflow functions to obtain remote code execution.

IOCs

Domains

No domain IOCs published by source

Full URL Paths

No URL IOCs published by source

Splunk Format

No IOCs available for Splunk query

File Hashes

No hash IOCs published by source

Detection Recommendations

Inventory Langflow versions and immediately upgrade every 1.0.0 through 1.10.0 deployment to 1.10.1 or later. Remove direct internet access to Langflow administration, auto-login, and code-validation functions, place the service behind authenticated access controls, and disable auto-login where it is not required. In reverse-proxy and Langflow application logs, alert when an unauthenticated source obtains an auto-login token and then accesses code validation; retain source IP, user agent, request URI, authentication state, session or token identifier, response status, request-body hash, and request timing. In EDR or container-runtime telemetry, alert when the Langflow or Python service spawns a shell, interpreter, downloader, or other unexpected child process, and capture parent process, command line, container ID, image digest, user, destination IP, and file writes. If an exposed vulnerable host shows suspicious activity, isolate it, rebuild it from a trusted image, and rotate application, database, cloud, and model-provider credentials accessible to the Langflow process.

References