CVE-2026-9198: Langflow minted superuser tokens for anyone, then executed what they sent

IBM's bulletin for CVE-2026-9198 describes a two-request takeover of Langflow OSS: a call to the platform's auto-login endpoint returns a superuser bearer token to whoever asks for it, and a second call posts Python to the code-validation endpoint, which runs it. The vendor files the chain's two halves under separate identifiers — CVE-2026-9103 for the missing authentication, CVE-2026-8481 for the execution — and rates the combination 9.8 on CVSS 3.1, reachable over the network with no privileges and no user interaction. Default deployments on versions 1.0.0 through 1.10.0 are affected; the remedy is 1.10.1, and IBM lists no workaround. The U.S. Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a federal remediation deadline of 7 August. The record, its severity and harm tags, and the entries filed around it are kept in the Orca AI Incident Archive, which lists this incident alongside the rest of the series.

The chain, in three IBM bulletins

IBM publishes this flaw as three documents rather than one, and reading them together is what makes the mechanism legible. The whole chain is CVE-2026-9198, a code-injection issue under CWE-94, scored 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network reachable, low complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability. Its first half, CVE-2026-9103, is missing authentication for a critical function under CWE-306, also 9.8. Its second half, CVE-2026-8481, is CWE-94 again but scored 9.9: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, low privileges rather than none, and scope changed.

The 9.9 is the honest part of the arithmetic. The code-validation endpoint was never open to strangers on its own — IBM describes it as a flaw that let "any authenticated user execute arbitrary system commands with the full privileges of the Langflow server process." What makes the chain unauthenticated is the first half: the auto-login endpoint, which in IBM's account "issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default)". The bulletin adds that the tokens carry a 365-day lifetime, and records a second exposure path that gets less attention — permissive cross-origin resource sharing defaults allowing wildcard origins with credentials, which IBM says "could enable drive-by token theft from arbitrary websites."

The execution half is the part worth dwelling on. IBM's summary says the validator "compiled and executed user-submitted code, including function definition-time evaluations such as default arguments and decorators," and that an attacker could therefore smuggle an executable expression into a default parameter or a decorator. That is not a figure of speech about unsafe code: a decorator is evaluated when the enclosing def is constructed, so a request whose only stated purpose is to check the syntax of a function still runs whatever is attached to it. IBM's own chained advisory says as much in a single clause — validation and execution were the same operation. The fix recorded in the CVE-2026-8481 bulletin was "removing code execution from the validation path and only performing compilation checks."

One small discrepancy is worth recording because it affects hunting. The chained bulletin writes the token endpoint as /api/v1/auto_login, and so do the Cloud Security Alliance and Field Effect; IBM's separate CVE-2026-9103 bulletin writes it as /api/v1/login/auto_login. Both IBM documents describe the same endpoint and neither is wrong about the behaviour. The execution path is written identically everywhere: POST /api/v1/validate/code.

Where the dates come from

The archive dates this record 6 August 2026. CISA's catalog entry, read on 30 October 2026, records the addition as 4 August 2026 and sets the remediation deadline at 7 August. The surrounding coverage sits on either side of the archive's date rather than on it: Field Effect published on 5 August, and cvetodo and Thailand's national computer emergency response team both published on 7 August. A listing, the deadline it produces and the articles written about it are three different events, so these dates do not contradict each other — but the two-day gap between the archive's field and CISA's is the reason to read the catalog when the exact day matters.

Disclosure is harder to pin down, and the sources genuinely disagree. IBM's bulletin page for the chained CVE carries an initial publication date of 2 July 2026 and a modification date of 17 August 2026. Field Effect dates IBM's disclosure to 2 July. The Cloud Security Alliance's research note of 18 August puts disclosure, and the release of 1.10.1 alongside it, at 17 July; cvetodo says the same. Fifteen days separate the two readings and neither document is careless, so this article does not choose between them. What is established either way is that the patch was published before the KEV listing, and that 1.10.1 is the release that carried it.

What CISA's entry says precisely, in its own fields, is narrower than its headline. The product sits under vendor IBM with product Langflow; the flaw is described as one "that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments"; known use in ransomware campaigns is recorded as Unknown; forensic triage is marked required under BOD 26-04; and the required action is to apply mitigations in accordance with vendor instructions, or to discontinue use of the product where mitigations are unavailable.

The exploitation record

CISA's listing asserts that the flaw was used in the wild. The public evidence behind that assertion is thinner than the 9.8 suggests. Neither IBM nor CISA has named a threat actor or published details of an observed campaign — Field Effect states this outright, and nothing in the three IBM bulletins or the KEV entry contradicts it.

What exists instead is vendor telemetry relayed second-hand. The Cloud Security Alliance's note cites KEVIntel for the claim that exploitation attempts were recorded beginning "around July 6, 2026", weeks before disclosure on the alliance's own reckoning, and that by mid-August cumulative attempts had grown into the hundreds, originating from several hundred unique internet addresses spread across dozens of countries. Those figures come from one monitoring firm and appear in no other source reviewed for this article. They are reported here, not corroborated.

The start date is worth a second look. If attempts really began around 6 July, that is four days after the bulletin date IBM's page carries, and eleven days before the 17 July date two other sources give. The telemetry therefore neither confirms nor refutes either disclosure date; the Cloud Security Alliance offers both explanations without choosing, describing the early activity as either independent discovery by opportunistic scanners or a leak of technical detail ahead of coordinated disclosure.

Public exploit code is the better-documented part. Field Effect attributes the chain's public description to "a public proof-of-concept published in July 2026" at the repository github.com/0xdak/CVE-2026-9198_exploit, and says the code demonstrates obtaining a superuser token through the auto-login endpoint and then using it against the validation endpoint. Field Effect does not connect that repository's author to any observed exploitation, and neither does this article. Nor does any source reviewed report a confirmed theft of credentials from an exploited host: the credential-harvesting description that accompanies Langflow flaws generally is an assessment about what such a host holds, covered below, not a finding about any named victim in this record.

Established, reported, and not established

• Established. That CVE-2026-9198 chains missing authentication in the auto-login endpoint with code execution in the code-validation endpoint; that IBM rates the chain 9.8 under CWE-94 and its two halves 9.8 and 9.9; that default deployments of Langflow OSS 1.0.0 through 1.10.0 are affected across Windows, macOS and Linux; that 1.10.1 is the fix and IBM publishes no workaround; and that CISA added the CVE to the KEV catalog with a federal deadline of 7 August 2026. The three IBM bulletins are the primary documents and they agree with one another on the mechanism.

• Independently restated. ThaiCERT reproduced the same two-endpoint chain, the same 9.8 score, the same affected range and the same 1.10.1 remedy in its 7 August 2026 advisory, and added a network control the IBM bulletins do not: keep Langflow's administrative interface off the public internet, and reach it only over a VPN or a strict address allow list. That is corroboration of how the advisory was read, by a government body with no stake in the vendor's wording — not independent discovery of the flaw.

• Reported, not corroborated. Every exploitation count: hundreds of attempts, several hundred addresses, dozens of countries, starting around 6 July. These are one monitoring firm's figures, relayed by a research body. CISA's listing confirms that exploitation happened without quantifying it, and no second telemetry source appears in the material reviewed here.

• Not established. No named victim and no named actor. No attribution to a state or to a criminal group. No confirmed figure for how many Langflow instances were reachable from the internet — cvetodo reported on 7 August that IBM had not answered questions about the scale of exploitation — and no vendor statement quantifying it since. The archive grades this record confidence A and does not mark it disputed, and nothing reviewed here disputes it; the gaps are gaps in the public evidence, not in the claim that the flaw exists and was used.

• Deliberately excluded. ThaiCERT's advisory also describes AI-directed automated scanning in the same week, but attaches it to a different product in the same CISA batch, not to Langflow. It is not evidence about this record and is not used here as such.

What changed after the listing

The vendor remedy is a version bump and nothing else. IBM's affected-product table lists Langflow OSS 1.0.0 through 1.10.0, names 1.10.1 as the fix, and puts "None" in the workarounds field — in all three bulletins. The CVE-2026-8481 bulletin describes the change: the validator stopped executing and started compiling. The CVE-2026-9103 bulletin, covering the auto-login half, does not spell out its fix in the same detail, and no IBM document reviewed here dates the 1.10.1 release.

Everyone else's guidance goes further than the vendor's. The Cloud Security Alliance recommends upgrading and then verifying at runtime that the auto-login endpoint no longer issues tokens to unauthenticated callers, rather than trusting the version string — its stated reason being that prior Langflow patches have shipped with incomplete fixes. It also recommends setting the LANGFLOW_AUTO_LOGIN environment setting to false explicitly, so the platform requires real credentials instead of minting them, and treating any instance that has been internet-facing since early July as compromised pending a log review, with credential rotation for everything the instance could reach: model provider keys, database credentials and cloud service keys. ThaiCERT adds the network half — no administrative interface on the public internet, VPN or allow list only. Both are the researchers' recommendations. IBM publishes none.

One credit line is on the record. IBM's acknowledgment attributes the report to Harish Kolla, GitHub handle Har1sh-k. The Cloud Security Alliance, in its 18 August note, places CVE-2026-9198 as the fourth distinct unauthenticated or authorisation-bypass Langflow flaw to reach CISA's catalog in roughly five months, naming the three earlier identifiers, and its reading is that the pattern reflects repeated piecemeal remediation of one authentication and code-execution model rather than unrelated defects. That framing is the alliance's assessment, offered in a research note; it is not a finding by an independent auditor, and no source reviewed here records a public response from the maintainers to it.

What the KEV listing does and does not settle

CISA's catalog is an assertion of observed exploitation, not an incident report, and this entry keeps to that form. It says the flaw was used; it does not say against whom, by whom, or how often. Ransomware use is recorded as Unknown. Nothing is quantified. What the listing does settle is the one question a severity score cannot: whether the flaw moved from a working proof of concept to real use. For organisations outside the reach of BOD 26-04 — which is most of the world — the 7 August deadline carries no obligation, and the fact behind it carries the same weight it would have carried with one.

The Cloud Security Alliance draws the operational conclusion from the same entry: that a KEV listing is a reliable signal exploitation has passed the proof-of-concept stage, and that for this flaw it arrived roughly a month after the first recorded attempts. Anyone who waited for the catalog before triaging was, on that reading, already responding to an incident rather than preventing one. Whether that describes a particular deployment is a question for its logs — the endpoint pair to search for is the one IBM documented, and the record does not name a single victim to test the answer against.