What is the CVSS score of CVE-2026-9202?

CVE-2026-9202 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow are affected by CVE-2026-9202?

IBM Langflow OSS versions 1.0.0-1.10.0 contain an unauthenticated account registration flaw enabling remote code execution when the NEW_USER_IS_ACTIVE configuration option is enabled.. A patch is available.

How to fix or mitigate CVE-2026-9202?

Within 24 hours, identify all internet-facing IBM Langflow instances and apply the latest patched version immediately. Within 7 days, verify patch deployment across all affected systems, audit authentication logs for suspicious account registrations created during the vulnerability window, and review any user accounts registered before patching for unauthorized access. Within 30 days, implement network segmentation to restrict direct internet access to Langflow instances, disable NEW_USER_IS_ACTIVE unless operationally required, and conduct a post-incident review of system access logs for evidence of exploitation.

IBM Langflow CVE-2026-9202

EUVD-2026-45235 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-17 ibm

GHSA-f8j5-5w75-w786

Authentication Bypass IBM Langflow Oss

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Account creation is unauthenticated and network-reachable (AV:N/PR:N), but full RCE impact depends on the non-default NEW_USER_IS_ACTIVE=true option, warranting AC:H over the vendor's AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 18:15 vuln.today

CVE Published

Jul 17, 2026 - 17:33 cve.org

CRITICAL 9.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.

AnalysisAI

Missing authentication in IBM Langflow OSS 1.0.0 through 1.10.0 lets unauthenticated remote attackers register unlimited user accounts against any exposed instance. When the documented NEW_USER_IS_ACTIVE=true option is set, those accounts become immediately active and can log in to reach known remote-code-execution endpoints, providing a full authentication foothold without relying on AUTO_LOGIN. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make internet-facing deployments a high priority.

Technical ContextAI

Langflow is an open-source, Python-based visual framework for building LangChain/LLM agent workflows, commonly self-hosted and exposed over HTTP. The flaw is CWE-306 (Missing Authentication for a Critical Function): the user-registration function is reachable without any credential, so the account-creation endpoint performs a security-critical action (provisioning identities) with no gate. The single affected package is identified by CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*. The severity escalates because Langflow already exposes flow-execution/code-execution endpoints that require only an authenticated session; combined with the NEW_USER_IS_ACTIVE=true deployment option (which marks freshly created accounts active rather than pending approval), the missing-auth registration effectively becomes an unauthenticated path to authenticated RCE.

RemediationAI

Patch available per vendor advisory - upgrade to the fixed IBM Langflow OSS release identified in the IBM advisory at https://www.ibm.com/support/pages/node/7278929 (no exact fixed version number is provided in the input data, so confirm the target build against that advisory). As compensating controls until patched, set NEW_USER_IS_ACTIVE=false so newly registered accounts require explicit activation/approval (this stops the immediate authenticate-to-RCE path but does not stop unauthenticated account creation itself); place the Langflow UI/API behind an authenticating reverse proxy, VPN, or IP allowlist to remove unauthenticated internet exposure (trade-off: breaks any intended public self-registration); and monitor for and disable/purge unexpected newly created accounts. Do not rely on AUTO_LOGIN settings as a control, since the flaw explicitly bypasses that mechanism.