CVE-2026-9198 — Unauthenticated RCE in IBM Langflow Under Active Exploitation (Auto-Login Bypass + Code Injection Chain) — Threadlinqs Intelligence
As of 2026-08-05, CVE-2026-9198 — Unauthenticated RCE in IBM Langflow Under Active Exploitation (Auto-Login Bypass + Code Injection Chain) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 7 indicators of compromise.
Threat ID: TL-2026-1893 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
IBM Langflow OSS versions 1.0.0 through 1.10.0 are under active exploitation via CVE-2026-9198 (CVSS 9.8), an unauthenticated remote code execution vulnerability that chains an auto-login endpoint
CVE-2026-9198 is a critical code injection vulnerability (CWE-94) in IBM Langflow OSS that chains two separately-classified CVEs into a full unauthenticated RCE chain. The first component, CVE-2026-9103 (CWE-306: Missing Authentication for Critical Function), resides in the /api/v1/login/auto_login endpoint. On default configurations — where AUTO_LOGIN is enabled by default in Langflow versions prior to 1.5 and remains a commonly-enabled setting in later versions — this endpoint returns a 365-day superuser bearer token to any network caller without credential verification. The feature was designed for single-user local development but is enabled by default in production builds, and permissive CORS defaults (wildcard origins with credentials) compound the risk by enabling potential drive-by token theft via cross-origin JavaScript requests.
The second component, CVE-2026-8481 (CWE-94: Code Injection), resides in the POST /api/v1/validate/code endpoint. This endpoint accepts user-supplied Python code and passes it directly to Python's built-in exec() function with no sandboxing, input validation, or privilege restrictions. Because Python evaluates function decorators, default arguments, and annotations at function definition time, an attacker can wrap a payload in a function default argument and achieve arbitrary command execution without the function ever being called. The typical payload pattern is: def _v(a=exec('<payload>')): pass. Command output is reflected in the function.errors[] field of the validation endpoint's JSON response.
Together, the chain works in two steps: (1) send an unauthenticated GET to /api/v1/auto_login to obtain a superuser JWT token; (2) use that token to POST a malicious Python payload to /api/v1/validate/code, achieving remote code execution on the host as the Langflow service user — frequently root, especially in Docker or systemd deployments where langflow run defaults to elevated privileges. A public proof-of-concept exploit is available on GitHub (0xdak/CVE-2026-9198_exploit) supporting single commands, interactive pseudo-shell, and reverse shell payloads.
The vulnerability affects all Langflow OSS versions 1.0.0 through 1.10.0 (inclusive) on Linux, Windows, and macOS. IBM recommends upgrading to version 1.10.1 or later, with the current release at 1.11.2. The fix for CVE-2026-8481 (PR #13696) changed the validate_code function to only compile each FunctionDef to surface syntax errors rather than exec()-ing it. The fix for CVE-2026-9103 (PR #13699) replaced the year-long superuser token with a short-lived 1-hour access token plus a refresh token, added logging warnings for auto-login sessions, and preserved the AUTO_LOGIN=True default only to avoid breaking changes until v2.0 — meaning administrative attention is still required to disable it in production.
Enterprise risk is amplified by Langflow's integration as middleware in IBM watsonx.ai and its role as an AI pipeline orchestrator. Compromised Langflow instances typically have privileged access to model registries, data lakes, cloud APIs, and credentials for multiple external AI services. According to CSO research, approximately 7,000 internet-accessible Langflow instances have been identified, with the majority in North America. A prior KEV-listed Langflow vulnerability (CVE-2026-33017, added March 2026) demonstrated similar RCE via an unauthenticated build endpoint, indicating a pattern of API security gaps in the platform.
Observed post-exploitation activity, documented by the Cloud Security Alliance's KeyHunter campaign research and VulnCheck's State of Exploitation 1H-2026 report, includes: credential harvesting from environment variables (capturing AWS, OpenAI, Anthropic, and database connection credentials); deployment of Go-based and Python-based worker binaries connecting to an authenticated NATS server (45.192.109.25:14222) for C2; cryptominer installation; lateral movement into cloud AI infrastructure including AWS S3, EC2, La
Weaknesses (CWE)
CWE-94, CWE-306
Target sectors: technology, government administration, finance, health, education, research
Target regions: North America, Europe, Asia Pacific
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 7 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-9198, CVE-2026-9103, CVE-2026-8481, T1190, T1078, T1133, T1059, T1053, T1543, T1552, T1046, T1538, T1005
