CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities catalog on August 4, 2026, confirming active exploitation of a critical code injection flaw that gives unauthenticated attackers full remote code execution on default IBM Langflow deployments.
What Is It
CVE-2026-9198 is a code injection vulnerability (CWE-94) in IBM Langflow OSS, scored CVSS 3.1 base 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Per the NVD record, an unauthenticated attacker chains two endpoints: /api/v1/auto_login, which mints SUPERUSER tokens to any network caller, and /api/v1/validate/code, which executes user-supplied code via exec(). The result is full RCE on default Langflow deployments. CISA tracks it as "IBM Langflow Code Injection Vulnerability."
Why It Matters
There is no authentication barrier, no user interaction, and no complexity hurdle; the attack is network-reachable with the default configuration. CISA's SSVC assessment (dated August 4, 2026) rates exploitation as active, automatable as yes, and technical impact as total. Automatable plus unauthenticated means mass internet-wide scanning and exploitation are practical. Known ransomware campaign use is listed as Unknown.
What's Vulnerable
IBM Langflow OSS versions 1.0.0 through 1.10.0 are affected. NVD's configuration data marks cpe:2.3:a:langflow:langflow vulnerable from 1.0.0 up to (but excluding) 1.10.1. Deployments running default settings are explicitly called out as exploitable.
Patch Status
IBM has published a vendor advisory (IBM support node 7278927). CISA's required action: apply mitigations in accordance with vendor instructions, in compliance with BOD 26-04 "Prioritizing Security Updates Based on Risk" and CISA's "Forensics Triage Requirements." For cloud services, follow applicable BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines. The KEV due date is August 7, 2026: three days after listing, an unusually tight window that reflects the severity.
Sources
- IBM Security Advisory; https://www.ibm.com/support/pages/node/7278927
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198
- NVD, CVE-2026-9198, https://nvd.nist.gov/vuln/detail/CVE-2026-9198
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements), https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk