CISA Adds a Third Actively Exploited Langflow Flaw to KEV (CVE-2026-9198)

IBM Langflow OSS versions 1.0.0 through 1.10.0

CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalog, among them CVE-2026-9198 (CVSS 9.8), an unauthenticated remote code execution flaw in Langflow that works against default deployments. The exploit chains two API endpoints: `/api/v1/auto_login` does not enforce authentication and is not bound to loopback, so it mints SUPERUSER tokens for any network caller, and `/api/v1/validate/code` then trusts that token and evaluates attacker-supplied Python through `exec()`. IBM disclosed and fixed the issue on July 17, 2026 in version 1.10.1. Researchers recorded 650 exploitation attempts beginning July 6, 2026 from 244 unique attacker IPs across 41 countries. This is the third Langflow flaw added to KEV in roughly a month, after CVE-2026-55255 and CVE-2026-0770. The other two additions in the same batch were CVE-2026-34486 in Apache Tomcat, which Unit 42 tied to the DeepSeek-driven Hermes agent campaign, and CVE-2026-18556 in N-able N-central. Federal civilian agencies were given until August 7, 2026 to remediate

An insecure default configuration combined with unsafe dynamic code evaluation. Auto-login exists as a developer convenience and remained reachable from the network in production deployments, so the code-validation endpoint's authentication requirement was satisfied by a token anyone could mint