Threat reportVulnerabilityTL-2026-1893
CVE-2026-9198 — Unauthenticated RCE in IBM Langflow Under Active Exploitation (Auto-Login Bypass + Code Injection Chain)
CVE-2026-9198 (TL-2026-1893), also tracked as KeyHunter, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-05. It has no confirmed attribution, affects IBM Langflow OSS, references 3 CVEs (CVE-2026-9198, CVE-2026-9103, CVE-2026-8481), maps to 12 MITRE ATT&CK techniques (T1005, T1046, T1053), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-1893
- Threat ID
- TL-2026-1893
- Also known as
- KeyHunter, Langflow Auto-Login + Code Injection Chain
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, education, research
- Target regions
- North America, Europe, Asia Pacific
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in CVE-2026-9198
Malware and tooling: KeyHunter, Python, Langflow
How CVE-2026-9198 works
IBM Langflow OSS versions 1.0.0 through 1.10.0 are under active exploitation via CVE-2026-9198 (CVSS 9.8), an unauthenticated remote code execution vulnerability that chains an auto-login endpoint issuing superuser JWT tokens to any unauthenticated network caller (CVE-2026-9103, CVSS 9.8) with an unrestricted Python code validation endpoint that executes arbitrary code via Python exec() (CVE-2026-8481, CVSS 9.9). CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities catalog on August 4, 2026, with a three-day remediation deadline under BOD 26-04. Langflow is integrated as middleware in IBM watsonx.ai. Observed post-exploitation activity includes credential harvesting, cryptominer deployment, and lateral movement into cloud AI infrastructure — a campaign dubbed KeyHunter uses the NATS pub/sub protocol as a C2 channel to exfiltrate AWS, OpenAI, and Anthropic credentials from compromised Langflow instances.
CVE-2026-9198 is a critical code injection vulnerability (CWE-94) in IBM Langflow OSS that chains two separately-classified CVEs into a full unauthenticated RCE chain. The first component, CVE-2026-9103 (CWE-306: Missing Authentication for Critical Function), resides in the /api/v1/login/auto_login endpoint. On default configurations — where AUTO_LOGIN is enabled by default in Langflow versions prior to 1.5 and remains a commonly-enabled setting in later versions — this endpoint returns a 365-day superuser bearer token to any network caller without credential verification. The feature was designed for single-user local development but is enabled by default in production builds, and permissive CORS defaults (wildcard origins with credentials) compound the risk by enabling potential drive-by token theft via cross-origin JavaScript requests.
The second component, CVE-2026-8481 (CWE-94: Code Injection), resides in the POST /api/v1/validate/code endpoint. This endpoint accepts user-supplied Python code and passes it directly to Python's built-in exec() function with no sandboxing, input validation, or privilege restrictions. Because Python evaluates function decorators, default arguments, and annotations at function definition time, an attacker can wrap a payload in a function default argument and achieve arbitrary command execution without the function ever being called. The typical payload pattern is: def _v(a=exec('<payload>')): pass. Command output is reflected in the function.errors[] field of the validation endpoint's JSON response.
Together, the chain works in two steps: (1) send an unauthenticated GET to /api/v1/auto_login to obtain a superuser JWT token; (2) use that token to POST a malicious Python payload to /api/v1/validate/code, achieving remote code execution on the host as the Langflow service user — frequently root, especially in Docker or systemd deployments where langflow run defaults to elevated privileges. A public proof-of-concept exploit is available on GitHub (0xdak/CVE-2026-9198_exploit) supporting single commands, interactive pseudo-shell, and reverse shell payloads.
The vulnerability affects all Langflow OSS versions 1.0.0 through 1.10.0 (inclusive) on Linux, Windows, and macOS. IBM recommends upgrading to version 1.10.1 or later, with the current release at 1.11.2. The fix for CVE-2026-8481 (PR #13696) changed the validate_code function to only compile each FunctionDef to surface syntax errors rather than exec()-ing it. The fix for CVE-2026-9103 (PR #13699) replaced the year-long superuser token with a short-lived 1-hour access token plus a refresh token, added logging warnings for auto-login sessions, and preserved the AUTO_LOGIN=True default only to avoid breaking changes until v2.0 — meaning administrative attention is still required to disable it in production.
Enterprise risk is amplified by Langflow's integration as middleware in IBM watsonx.ai and its role as an AI pipeline orchestrator. Compromised Langflow instances typically have privileged access to model registries, data lakes, cloud APIs, and credentials for multiple external AI services. According to CSO research, approximately 7,000 internet-accessible Langflow instances have been identified, with the majority in North America. A prior KEV-listed Langflow vulnerability (CVE-2026-33017, added March 2026) demonstrated similar RCE via an unauthenticated build endpoint, indicating a pattern of API security gaps in the platform.
Observed post-exploitation activity, documented by the Cloud Security Alliance's KeyHunter campaign research and VulnCheck's State of Exploitation 1H-2026 report, includes: credential harvesting from environment variables (capturing AWS, OpenAI, Anthropic, and database connection credentials); deployment of Go-based and Python-based worker binaries connecting to an authenticated NATS server (45.192.109.25:14222) for C2; cryptominer installation; lateral movement into cloud AI infrastructure including AWS S3, EC2, Lambda, CloudWatch, ECS, SageMaker, and IAM reconnaissance; LLMjacking through Bedrock InvokeModel API calls; and establishing persistence via systemd services with Restart=always flags and cron entries. The time from initial probe to validated cloud credential exfiltration was measured at under 15 minutes in observed campaigns.
Under CISA BOD 26-04 (Prioritizing Security Updates Based on Risk), all federal agencies and FedRAMP-authorized cloud service providers must remediate CVE-2026-9198 by August 7, 2026 — a three-day patching window from the August 4 KEV addition date. The SSVC score rates exploitation as active, automatability as yes, and technical impact as total. CISA's required action mandates applying mitigations per vendor instructions and evaluating each asset's internet exposure.
MITRE ATT&CK techniques used in TL-2026-1893
Collection
Discovery
T1046 Network Service Discovery; T1538 Cloud Service Dashboard
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
Credential Access
Affected products and versions in CVE-2026-9198
Remediation for CVE-2026-9198
Patches
- Upgrade to Langflow OSS 1.10.1 or later (fixes merged in PR #13696 for code validation and PR #13699 for auto-login)
- IBM watsonx.ai customers should apply IBM's Langflow middleware patch per vendor guidance
Immediate actions
- Upgrade Langflow OSS to version 1.10.1 or later (current release: 1.11.2)
- Set LANGFLOW_AUTO_LOGIN=false and restart the Langflow service
- Configure real superuser credentials: LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD
- Block external network access to Langflow API port 7860 at the perimeter firewall
- Deploy Langflow behind an authenticating reverse proxy or VPN
- Rotate all superuser credentials and invalidate outstanding bearer tokens
- Conduct forensic review of compromised Langflow instances for signs of credential harvesting, cryptominer deployment, or unauthorized API calls to AWS Bedrock/OpenAI/Anthropic
Workarounds
- Set LANGFLOW_AUTO_LOGIN=false with strong superuser credentials as an interim workaround if patching is delayed
- Restrict Langflow to localhost binding or internal network only
- Implement Web Application Firewall (WAF) rules to block requests to /api/v1/auto_login and /api/v1/validate/code from untrusted sources
Longer-term hardening
- Set LANGFLOW_NEW_USER_IS_ACTIVE=false to prevent automatic user activation
- Configure strict CORS allowlist via LANGFLOW_CORS_ORIGINS for operator-controlled origins only
- Implement identity-based access controls for cloud credentials used by AI pipeline infrastructure
- Adopt just-in-time credential provisioning for AI/ML cloud services
- Deny all egress traffic not explicitly permitted from Langflow deployment environments
- Audit all internet-facing Langflow instances and migrate internal instances behind VPN
- Monitor for unusual HTTP POST traffic to Langflow API endpoints
- Ensure validate_code endpoint returns 401/403 for unauthenticated requests: curl -X POST http://localhost:7860/api/v1/run/test -H 'Content-Type: application/json' -d '{}'
CVEs associated with CVE-2026-9198
Weaknesses (CWE) in CVE-2026-9198
Timeline of CVE-2026-9198
- DataStax acquires Langflow (originally founded by Logspace in 2022)
- IBM announces intent to acquire DataStax, including Langflow and AstraDB
- IBM closes DataStax acquisition; Langflow integrated into IBM watsonx.ai portfolio
- Langflow PR #13696 merged to fix code validation RCE (CVE-2026-8481); PR #13699 merged to fix auto-login (CVE-2026-9103)
- IBM publishes CVE-2026-9198, CVE-2026-9103, and CVE-2026-8481; initial SSVC assessment shows no active exploitation; Langflow 1.10.1 released
- NIST initial analysis adds CPE configuration and IBM reference for CVE-2026-9198
- CISA adds CVE-2026-9198 to Known Exploited Vulnerabilities catalog; exploitation status updated to active; federal remediation deadline set to August 7, 2026 under BOD 26-04
- The Register publishes article confirming active exploitation of Langflow via CVE-2026-9198 chain; CISA-ADP and NIST update CVE-2026-9198 records with SSVC active/yes/total ratings
Sources cited for CVE-2026-9198
- CISA Adds Three Known Exploited Vulnerabilities to Catalog
- IBM's agentic AI platform is under active attack — patch now
- CVE-2026-9198 — NVD Detail
- CVE-2026-9103 — NVD Detail (Auto-Login Bypass)
- CVE-2026-8481 — NVD Detail (Code Validation RCE)
- GitHub Security Advisory GHSA-5wm9-vgmg-cjv6
- SentinelOne Vulnerability Database — CVE-2026-9103
- IBM Security Bulletin (node/7278927)
- Public PoC Exploit — CVE-2026-9198 (0xdak)
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
- CSA Research Note: Langflow RCE — AI Infrastructure Risk
- CSA Research Note: NATS-as-C2 — Cloud Credential and AI Key Exfiltration (KeyHunter)
- VulnCheck — State of Exploitation 1H-2026
- GitHub Fix PR #13696 — Code Validation (CVE-2026-8481)
- GitHub Fix PR #13699 — Auto-Login (CVE-2026-9103 / GHSA-fjgc-vj2f-77hm)
Detection coverage for TL-2026-1893
As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1893 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.