CVE-2026-9198 IBM Langflow Code Injection

What is CVE-2026-9198?

CVE-2026-9198 is a critical code injection vulnerability in Langflow Langflow, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

Weakness: CWE-94

Which versions are affected by CVE-2026-9198?

It affects 1 product.

Products include Langflow Langflow.

How do I fix CVE-2026-9198?

No fix has been published for CVE-2026-9198 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 7 Aug 2026.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-9198 being exploited?

Yes. Attackers have exploited CVE-2026-9198 in the wild since at least 4 Aug 2026.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 9 proofs of concept on GitHub.

Other vulnerabilities in Langflow Langflow

• CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Exploited Critical 9.8
• CVE-2025-3248 Langflow Missing Authentication Exploited Critical 9.8
• CVE-2025-34291 Langflow Origin Validation Error Exploited Critical 9.4
• CVE-2026-33017 Langflow Code Injection Exploited Critical 9.3
• CVE-2026-55255 Langflow Authorization Bypass Through User-Controlled Key Exploited High 8.4

All Langflow Langflow vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5wm9-vgmg-cjv6.