vuln.management
Act nowKnown exploited

Advisory · CVE-2026-9198

Unauthenticated Langflow code injection is in CISA KEV

CISA says default Langflow deployments may permit unauthenticated attackers to achieve full remote code execution.

Advisory published July 2, 2026Independent summary
Vendor
IBM
Product
Langflow
Identifier / CWE
CVE-2026-9198
CWE-94
Action timing
Aug 7, 2026
ELI5

Explain it like I’m five

A stranger can hand Langflow a note that looks like ordinary input but contains computer instructions. Langflow may run those instructions and give the stranger control of the machine.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Public request

    An unauthenticated attacker reaches a default Langflow deployment.

  2. 02Injected code

    Attacker-controlled input crosses into a code-execution path.

  3. 03Host compromised

    The Langflow server runs code chosen by the attacker.

  4. 04Connections exposed

    Model keys, databases, vector stores, and tool permissions may be reachable.

What happened

CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities catalog on August 4, 2026. CISA describes a code-injection vulnerability that can allow an unauthenticated attacker to obtain full remote code execution on default Langflow deployments.

Langflow deployments may connect to model providers, vector stores, databases, internal APIs, and other tools. A server compromise can therefore expose credentials and trusted paths that are not obvious from the public endpoint alone.

What to do

  1. Locate Langflow instances across production, development, demos, and individual cloud accounts.
  2. Identify deployments reachable from the internet or broadly accessible internal networks.
  3. Apply the IBM-provided fix or mitigation after confirming affected versions in the vendor bulletin.
  4. Restrict access while remediation and investigation are in progress.
  5. Review flows, components, user changes, spawned processes, outbound connections, and available platform logs for unexpected activity.
  6. Inventory model keys, database credentials, tokens, and tool permissions available to the deployment; rotate them if compromise cannot be excluded.
  7. Verify both the deployed version and the resulting network boundary.

Management note

CISA’s required-action date for covered agencies was August 7, 2026. Teams discovering an affected deployment after that date should treat remediation and compromise assessment as overdue, not merely add the issue to a normal patch queue.

Consult the IBM bulletin for authoritative version and remediation details.