• Active Exploitation — CISA KEV
Langflow RCE Vulnerability Explained: How CVE-2026-9198 Put IBM's Agentic AI Platform Under Active Attack
A single unauthenticated request chain is all it takes to seize a Langflow host as superuser. Here’s exactly how the flaw works, who’s affected and how to close it.
CVSS · Critical
9.8
On August 5, 2026, CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog, confirming what The Register first reported: the Langflow RCE vulnerability inside IBM’s watsonx.ai ecosystem is being actively exploited in the wild. This Langflow vulnerability lets an unauthenticated attacker seize full control of a default Langflow deployment with nothing more than two crafted HTTP requests no password, no login, no user interaction.
For any organization running agentic AI workflows, this isn’t a routine patch-Tuesday item. It’s a live, unauthenticated remote code execution vulnerability sitting inside AI infrastructure that often holds API keys, model-provider credentials and connections to internal systems. Below, we break down exactly how the Langflow RCE vulnerability works, why this agentic AI platform attack matters beyond IBM’s user base and what identity and security teams should do right now.
What is Langflow and why does this Langflow vulnerability matter?
Langflow is an open-source, low-code platform for building AI agents, retrieval-augmented generation pipelines and Model Context Protocol workflows through a drag-and-drop visual interface. It was originally built by Logspace, acquired by DataStax in 2024 and came under IBM’s ownership in 2025 when IBM acquired DataStax. IBM has since folded Langflow into watsonx.ai as middleware that extends the platform’s agent-building capabilities making it one of the more accessible agentic AI platforms on the market, requiring little coding knowledge to wire together LLMs, tools and data sources.
That accessibility is exactly why the Langflow RCE vulnerability is so dangerous. Because Langflow sits at the center of AI agent workflows, a compromised instance is rarely an isolated box. It typically holds model-provider API keys, database credentials, connector tokens and files that are more valuable to an attacker than the underlying server itself. A single unauthenticated remote code execution vulnerability here can cascade into a much larger AI supply chain attack
How the CVE-2026-9198 Langflow RCE vulnerability actually works
CVE-2026-9198 carries a CVSS score of 9.8, the highest severity rating on the scale and affects IBM Langflow OSS versions 1.0.0 through 1.10.0. IBM patched the issue in version 1.10.1, though its broader July security bulletin recommends organizations move to 1.10.2 to close related unauthenticated and insufficiently authorized API issues in the same release family.
The Langflow RCE vulnerability is a textbook case of endpoint chaining, where two individually risky design choices combine into a critical unauthenticated remote code execution vulnerability:
Step one: the /api/v1/auto_login endpoint issues a SUPERUSER authentication token to any network caller, without requiring a username, password, or any other credential.
Step two: the attacker takes that freshly minted SUPERUSER token and sends it to the /api/v1/validate/code endpoint, which was designed to let developers test Langflow node logic by executing submitted Python code through Python’s exec() function.
Chain those two together and an attacker anywhere on the network can go from zero access to arbitrary code execution as a superuser, on a default Langflow deployment, without ever authenticating. IBM classifies the flaw under CWE-94, Improper Control of Generation of Code. No user interaction is required, no privileges are required, and the impact per the official NVD record for CVE-2026-9198 is rated complete loss of confidentiality, integrity, and availability. That severity is exactly why CISA moved to add it to the Known Exploited Vulnerabilities catalog within weeks of disclosure.
The Langflow RCE vulnerability is part of a pattern, not a one-off
CVE-2026-9198 is not Langflow’s first brush with critical, actively exploited flaws in 2026 and that pattern matters for any risk assessment of this agentic AI platform.
CVE-2026-33017 was previously used to deploy a cryptominer called “lambsys” a Go-based binary that killed 39 competing cryptomining processes, disabled security tooling including AppArmor, SELinux and iptables and wiped system logs before installing a customized XMRig Monero miner. That’s the caliber of automated, opportunistic attacker already scanning for exposed Langflow instances and it’s a preview of what unpatched CVE-2026-9198 deployments can expect.
Why this agentic AI platform attack should worry identity and access teams
Most conversations about AI agent security focus on prompt injection or model behavior. The Langflow RCE vulnerability is a reminder that the infrastructure running agentic AI platforms is ordinary software with ordinary API design mistakes and it needs to be governed the same way as any other privileged system. An unauthenticated attacker who lands SUPERUSER code execution on a Langflow host doesn’t just compromise that host they inherit every credential, connector and privileged session the AI agent platform was trusted with.
This is precisely the blind spot that privileged access management exists to close. If you’ve read our earlier breakdown of Identity Threat Detection and Response and how it differs from IAM and EDR, this attack chain will look familiar: it’s another case where identity, not the network perimeter, is the real control plane. A properly vaulted, just-in-time credential model would have stopped the auto-login endpoint from handing out a standing SUPERUSER token in the first place and session isolation would have limited what that token could actually reach.
We saw a similar dynamic in our analysis of the JADEPUFFER ransomware attack chain the entry point differs, but the underlying lesson is identical: unmanaged privileged access turns a single vulnerability into a full compromise.
How to patch and mitigate the Langflow RCE vulnerability
- ⚠ Immediate action checklist
- 1. Patch Langflow to version 1.10.2 or later not just 1.10.1 per IBM's July security bulletin.
- 2. Remove Langflow instances from direct internet exposure; place them behind an authenticating reverse proxy or VPN.
- 3. Rotate every secret, API key and model-provider credential stored in flows on any potentially exposed host.
- 4. Audit affected hosts for indicators of compromise new cron jobs, unfamiliar SSH keys, unexpected outbound connections.
- 5. Baseline normal Langflow API traffic and alert on anomalies, especially anonymous calls to authentication endpoints.
- 6. Extend privileged access controls credential vaulting, session recording, just-in-time elevation to the service accounts and API keys your AI agent platforms depend on, not just human admins.
IBM’s advisory and CISA’s KEV catalog entry are the two sources to monitor for updates, since Langflow’s 2026 CVE history suggests this won’t be the platform’s last critical disclosure. (See sources below.)
The bottom line
The Langflow RCE vulnerability behind CVE-2026-9198 is a clear signal that agentic AI platforms are now a mainstream attack surface, not an experimental one. IBM’s fix is available, but patching alone won’t close the gap if the credentials and access these platforms hold remain unmanaged. As AI agents get wired deeper into enterprise systems, the organizations that treat every agent, API key and service account as a privileged identity not just human admins will be the ones that turn the next Langflow-style disclosure into a non-event instead of a breach.
Worried about standing privileged access in your AI stack?
Hassium helps enterprises vault, monitor and govern the credentials AI agents and service accounts rely on before they become the next attack chain.
Frequently Asked Questions (FAQs)
What is CVE-2026-9198?
CVE-2026-9198 is a critical, CVSS 9.8 unauthenticated remote code execution vulnerability in IBM Langflow OSS, the open-source AI agent builder integrated into watsonx.ai. It lets attackers chain the auto-login and code-validation API endpoints to run arbitrary Python code as a superuser.
Is Langflow safe to use after patching?
Langflow is safer once updated to version 1.10.2 or later, but organizations should still isolate any AI agent platform from direct internet exposure, rotate credentials that may have been exposed and monitor API traffic, since Langflow has had multiple critical CVEs in 2026 alone.
Why is IBM's agentic AI platform being actively attacked?
Langflow is widely deployed, easy to expose to the internet by default and typically holds high-value credentials for connected AI models and services making it an attractive unauthenticated remote code execution target for opportunistic attackers, including cryptomining campaigns.
How do I know if my Langflow deployment is affected?
Any Langflow OSS instance running versions 1.0.0 through 1.10.0 is affected by the Langflow RCE vulnerability. Confirm your deployed version directly rather than trusting a container tag and check CISA’s Known Exploited Vulnerabilities catalog for the latest guidance.
What is the connection between this vulnerability and privileged access management?
The Langflow RCE vulnerability hands an attacker a superuser-level credential with no authentication step exactly the kind of standing, unmanaged privileged access that PAM controls like credential vaulting and just-in-time elevation are designed to prevent.