Critical RCE Flaw in IBM Langflow Under Active Exploitation

A critical remote code execution (RCE) vulnerability, CVE-2026-9198, in IBM's Langflow platform is currently being exploited. The flaw affects default deployments of Langflow OSS versions 1.0.0 to 1.10.0, allowing unauthenticated attackers to execute arbitrary code remotely. The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on August 4, 2026, after confirming active exploitation. IBM recommends upgrading to version 1.10.1 or later, with version 1.11.2 being the latest release. The vulnerability arises from an auto-login endpoint that grants superuser tokens and a code validation endpoint that executes any Python code. Organizations using default configurations are particularly at risk. The CVE was published on July 17, 2026, and a public proof of concept (PoC) appeared on July 24, 2026.

Key Points: • CVE-2026-9198 is a critical RCE vulnerability in IBM's Langflow platform. • The flaw affects default deployments and allows unauthenticated remote code execution. • CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 4, 2026.