Langflow CVE-2026-9198: An AI Platform Entered the KEV Catalog Twice in Fifteen Days

CISA added CVE-2026-9198 in IBM Langflow to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for federal agencies. It is a code-injection flaw rated CVSS 9.8 that gives an unauthenticated attacker remote code execution on default deployments. It was patched on 17 July in version 1.10.1, and a working public exploit followed roughly a week later.

Langflow is an open-source visual builder for AI applications and agent workflows — the kind of tool a team stands up to prototype something, and then quietly keeps. On 21 July we wrote about CVE-2026-0770, a different Langflow flaw entering the same catalog. Fifteen days later the product is back. That pattern is the story here, more than either individual bug.

How the exploit chain works

The mechanism is worth describing precisely, because it is not exotic and it is not a memory-safety puzzle. Two API endpoints, each of which does something a developer deliberately built:

• An unauthenticated endpoint that issued superuser bearer tokens to any caller that could reach it over the network.
• A code-validation endpoint that executed arbitrary Python. In a tool whose entire purpose is letting users compose and run code-backed components, an endpoint that evaluates code is not an accident. It is a feature.

Chain them and you have unauthenticated remote code execution in two requests. No exploit development, no memory corruption, no race window. Get a token from the first endpoint, send code to the second.

Neither endpoint is indefensible on its own. The token endpoint is the sort of thing that makes sense in a single-user, localhost-bound development tool. The code endpoint is the product. The vulnerability is what happens when both are exposed on the same network interface, which is what “default deployments are affected” means.

The deployment default is the vulnerability

AI development tooling has been shipping with the ergonomics of a local notebook and the network posture of a server. That combination is fine on a laptop and hostile on an internet-facing host, and the gap between those two situations is one docker run and a security group.

It is a specific and predictable failure. A tool is written for one trusted user on one machine. Trust in that context is implicit — of course the caller is you, who else would it be. Then the tool becomes useful, and someone deploys it for a team, and the implicit assumption stays implicit while the network around it changes completely. Nobody removed a control; the control was never written, because in the original setting there was nothing to control.

You will see this again. The wave of AI tools built over the past two years is largely at the stage where prototypes are becoming infrastructure, and the authentication story is the part that lags.

What to do

1. Upgrade to Langflow 1.10.1 or later, and check the version you are actually running rather than the one in your compose file — container image tags drift.
2. Get it off the internet. There is no version of this tool that belongs on a public IP. Put it behind your identity provider or a VPN, and confirm from outside your network rather than assuming your ingress rules say what you think.
3. If it was exposed while unpatched, investigate rather than patch. A public exploit plus a KEV listing means opportunistic scanning. Look for unexpected outbound connections from the host, new processes and scheduled tasks, and modifications to flow definitions.
4. Rotate every credential the instance held. Langflow deployments accumulate API keys — model providers, vector stores, databases, internal services. Code execution on the host means all of them, and this is the step that takes real time.
5. Check CVE-2026-0770 too. If this instance has been running since July without attention, it may be behind on both.
6. Inventory the rest. Langflow is the one with a CVE this week. Ask which other AI tools your teams have deployed, who can reach them, and whether anything authenticates in front of them.

The uncomfortable part

A Langflow flaw has already been exploited by an autonomous attack agent in a previously reported campaign. That is the loop closing: AI tooling as the target, AI tooling as the attacker, at machine speed against a bug with a public exploit.

The defensive conclusion is not novel, which is rather the point. Time-to-exploit is now shorter than most patch cycles, so the controls that matter are the ones that hold while you are still deciding — network exposure, authentication in front of everything, credentials scoped so that one compromised host is not a compromised estate. None of that depends on knowing about a CVE in advance.

Related reading: a CVSS 10.0 in HashiCorp's Terraform MCP Server, published the same week, where the failure is isolation rather than code execution — and the AISI incident report, on what agents do when a goal is out of reach.

Sources

• CISA Known Exploited Vulnerabilities Catalog
• The Hacker News: CISA flags Langflow RCE, Tomcat and N-central flaws as actively exploited
• SecurityWeek: CISA warns of exploited Langflow, N-central and Tomcat vulnerabilities
• BleepingComputer: CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws