Missing authentication for user registration in Langflow OSS (CVE-2026-9202)

CVE-2026-9202 is a missing authentication vulnerability (CWE-306) in Langflow OSS that allows unauthenticated attackers to create unlimited user accounts via the user registration API. When the NEW_USER_IS_ACTIVE=true deployment option is configured, newly created accounts are immediately active, enabling attackers to authenticate and reach code-execution endpoints, resulting in remote code execution with the privileges of the server process. Even without that configuration, the flaw enables unauthorized account creation for resource exhaustion or dormant-account scenarios. CVSS Base Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 9.8 · our assessment: act_now Vendor advisory: https://www.ibm.com/support/pages/node/7278929 Details: https://vuln.today/cve/CVE-2026-9202