Back Feeds.4Sysops

Patch IBM Langflow now: CISA flags actively exploited CVE-2026

Feeds.4Sysops •IT News • August 5, 2026

Langflow is an open-source, visual low-code framework for building AI applications, agents, and retrieval-augmented-generation workflows. IBM owns and supports the project after acquiring DataStax in 2025, while Langflow remains available as open-source software. CVE-2026-9198 is now under active attack against default Langflow deployments, prompting CISA to add the critical remote code execution flaw to its Known Exploited Vulnerabilities catalog. IBM advises upgrading Langflow OSS to version 1.10.1 or later; version 1.11.2 is currently the newest release. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in IBM Langflow Under Active Exploitation IBM Langflow OSS is facing a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-9198, which allows unauthenticated attackers to execute arbitrary code on default deployments. The vulnerability combines an authentication bypass with a code execution flaw, enabling attackers to gain superuser access via the /api/v1/auto_login endpoint and execute code through the /api/v1/validate/code endpoint. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this CVE to its Known Exploited Vulnerabilities catalog on August 4, 2026, following evidence of active exploitation. Organizations using Langflow OSS versions 1.0.0 to 1.10.0 are advised to upgrade to version 1.10.1 or later immediately. The vulnerability has a CVSS score of 9.8, indicating its critical nature, and poses significant risks to organizations that have not hardened their default configurations. The urgency is further emphasized by a federal directive requiring remediation by August 7, 2026. 7 sources 80

Extracted Entities

Patch IBM Langflow now: CISA flags actively exploited CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)