CVE-2026-9198 — added to the CISA Known Exploited Vulnerabilities catalog and published July 17 — describes a critical flaw in IBM-owned Langflow that can let unauthenticated attackers execute code remotely on default deployments.
CISA action and IBM’s warning after evidence of active exploitation
The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog after identifying evidence of active exploitation, and urged organizations to apply the vendor's mitigation guidance as soon as possible. IBM has acknowledged the vulnerability and issued guidance: upgrade Langflow OSS to version 1.10.1 or later. At the time of writing, the most recent Langflow release is 1.11.2.
Which Langflow releases and deployments are affected
- IBM says the flaw affects Langflow OSS versions 1.0.0 through 1.10.0.
- IBM reports the vulnerability specifically impacts default Langflow deployments.
- IBM recommends upgrading to Langflow 1.10.1 or later to remediate the problem.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageThe technical chain: auto-login plus an unsafe code-validation endpoint
IBM describes the exploit as a two-issue chain in default configurations. First, an auto-login endpoint in default deployments can mint superuser tokens for any network caller. Second, a code validation endpoint will execute arbitrary Python code supplied to it. Combine easily obtained superuser privileges from the auto-login endpoint with the code validation endpoint’s willingness to run any Python, and an unauthenticated attacker can achieve remote code execution (RCE) on a vulnerable Langflow server.
Langflow’s role and ownership history — why this matters to enterprise deployments
Langflow is a low-code, drag-and-drop GUI for building agentic and retrieval-augmented-generation (RAG) workflows and is available on Linux, Windows, and macOS. The platform was originally developed by Logspace, acquired by DataStax in 2024, and then acquired by IBM in 2025. That acquisition path enabled Langflow to be integrated into watsonx.ai as middleware extending the AI development studio’s capabilities. Despite those ownership changes and integrations, IBM says the critical flaw made it into production releases before being fixed.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Patch default Langflow deployments immediately — IBM’s remediation is to upgrade to 1.10.1 or later, and CISA has flagged the CVE as actively exploited. The attack path depends on default configuration settings (auto-login and an exposed code validation endpoint), so teams should verify deployment configuration in addition to applying updates.
- Procurement leaders and integrators: Products acquired through corporate mergers (Logspace → DataStax → IBM) can inherit code and configuration risks; ensure vendor-supplied guidance and updates are tracked and enforced across any embedded or middleware components such as Langflow inside watsonx.ai.
- End users and administrators: Because the vulnerability targets default deployments, administrators should assume a higher risk if they are running vanilla installations with auto-login enabled and exposed endpoints, and follow IBM’s upgrade guidance and any additional mitigation steps CISA or the vendor publish.
The published record leaves a clear, immediate obligation: patch. CVE-2026-9198 was posted July 17, CISA has confirmed active exploitation, and IBM has supplied a targeted fix — yet IBM says it is unknown how extensively the vulnerability has been exploited. For organizations running default Langflow instances the risk is concrete and actionable: upgrade to 1.10.1 or later and review deployment defaults. How many installations still run the vulnerable default configuration, and what attacker activity has already occurred on exposed systems, remain open questions that further reporting will need to answer.
