What is the CVSS score of CVE-2026-9198?

CVE-2026-9198 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow OSS are affected by CVE-2026-9198?

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an unauthenticated remote code execution vulnerability allowing any network-connected attacker to execute arbitrary code on default deployments;…. A patch is available.

Is there a public PoC exploit available for CVE-2026-9198?

Yes, a public proof-of-concept exploit is available for CVE-2026-9198. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-9198?

Within 24 hours: inventory all IBM Langflow OSS deployments and identify instances running versions 1.0.0 through 1.10.0; immediately restrict network access to these systems from untrusted sources or isolate from production networks if restriction is impractical. Within 7 days: obtain and apply the vendor-released patch to all affected Langflow deployments and verify patching completion across your infrastructure. Within 30 days: audit compromised systems for indicators of unauthorized access to the /api/v1/auto_login and /api/v1/validate/code endpoints, review execution logs for suspicious code patterns, and implement enhanced monitoring for unusual API activity on patched systems.

IBM Langflow OSS CVE-2026-9198

EUVD-2026-45236 CRITICAL

Code Injection (CWE-94)

2026-07-17 ibm

GHSA-5wm9-vgmg-cjv6

Code Injection IBM RCE Langflow Oss

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

auto_login grants SUPERUSER tokens to any unauthenticated network caller (PR:N, AV:N, AC:L), and exec()-based code execution yields full host compromise (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Aug 04, 2026 - 17:16 CISA

Analysis Generated

Jul 17, 2026 - 18:16 vuln.today

CVE Published

Jul 17, 2026 - 17:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

Articles & Coverage 1

POC CVE-2026-9198: IBM Langflow Unauthenticated RCE via Auto-Login Bypass Chain Jul 24, 2026

AnalysisAI

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attacker achieve full RCE on default deployments by chaining two endpoints: /api/v1/auto_login, which mints SUPERUSER tokens to any caller, and /api/v1/validate/code, which passes user-supplied code to Python's exec(). CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N) and a vendor patch is available; there is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Langflow is a Python-based, low-code visual builder for LangChain/LLM agent workflows, commonly self-hosted as a web service. The vulnerability is a CWE-94 Code Injection: the /api/v1/validate/code endpoint is intended to validate flow component code but ultimately evaluates it through Python's exec(), so attacker-controlled input runs in the server process. This is compounded by a broken authentication design in /api/v1/auto_login, which in default configuration issues SUPERUSER-level session tokens to any unauthenticated caller, removing the access control that would otherwise gate the code-validation path. The affected package is identified by CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to the fixed IBM Langflow OSS release per the vendor advisory at https://www.ibm.com/support/pages/node/7278927 (Patch available per vendor advisory; the exact fixed version is not stated in the provided data and should be taken directly from IBM's page). As compensating controls until patched, disable the insecure auto-login behavior by setting LANGFLOW_AUTO_LOGIN=false and configuring real authentication with defined superuser credentials, which forces callers to authenticate before reaching any privileged endpoint - the trade-off is that all users must now log in and any automation relying on anonymous access will break. Additionally, restrict network access to the Langflow service by placing it behind a VPN, reverse proxy with authentication, or firewall rules, and specifically block or deny external access to /api/v1/auto_login and /api/v1/validate/code at the proxy layer; note this may interfere with legitimate flow-editing features that call validate/code. Do not expose Langflow directly to the internet.