Langflow CVE-2026-9198: CVSS 9.8 Unauthenticated RCE on Every Default AI Agent Deployment — /auto_login Mints SUPERUSER Tokens for Anyone, /validate/code Executes Arbitrary Python, CISA KEV

Sources: CISA KEV Catalog — CVE-2026-9198 entry (August 5, 2026, primary) · SecurityWeek — “CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities” (two-endpoint chain confirmed) · The Hacker News — “CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited” · SentinelOne Vulnerability Database — CVE-2026-9198 full technical analysis · CIRCL Vulnerability Lookup — CVE-2026-9198 (additional related CVEs in same version range) · IBM Security Advisory — Langflow 1.10.1 patch notes · TechTimes — “CISA Adds First AI Agent Platform to KEV” (prior Langflow KEV context) | CVE: CVE-2026-9198 | CVSS v3.1: 9.8 | CWE: CWE-94 — Improper Control of Generation of Code | Affected: Langflow OSS 1.0.0 – 1.10.0 (all default deployments) | Fixed: Langflow 1.10.1 (IBM patch, July 2026) | CISA KEV added: August 5, 2026 | Exploitation status: Actively exploited — no details on specific threat actors for CVE-2026-9198 specifically | DeepSeek/Tomcat link: CVE-2026-34486 (Apache Tomcat, also KEV today) confirmed exploited by Chinese threat actor using DeepSeek via Hermes Agent framework | Langflow KEV history: Second Langflow CVE in CISA KEV — prior entry July 7, 2026 | What’s stored in Langflow flows: OpenAI/Anthropic/Google API keys · database credentials · webhook secrets · OAuth tokens · system prompts

“The vulnerability combined two distinct issues: an unauthenticated endpoint that issued superuser bearer tokens to any network caller, and a code validation endpoint that executed arbitrary Python code.” — SecurityWeek. Two API endpoints. One chain. Full host compromise. Every credential stored in every flow.

On August 5, 2026, CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog — a CVSS 9.8 unauthenticated remote code execution vulnerability in Langflow, the open-source AI agent workflow builder maintained by IBM. The vulnerability affects every default Langflow deployment running versions 1.0.0 through 1.10.0. IBM patched it in Langflow 1.10.1 in July 2026. CISA’s KEV addition today confirms active exploitation in the wild.

The technical simplicity of the exploit chain is what makes CVE-2026-9198 so dangerous. The Langflow OSS bug allows unauthenticated attackers to chain two API endpoints for remote code execution. The vulnerability combined two distinct issues: an unauthenticated endpoint that issued superuser bearer tokens to any network caller, and a code validation endpoint that executed arbitrary Python code. The entire exploit is two HTTP requests. No credentials. No brute force. No social engineering. Any network-reachable Langflow instance running a pre-1.10.1 version is fully compromised by anyone who can reach it.

The two-endpoint chain — exactly how the exploit works

Endpoint 1: /api/v1/auto_login — the token dispenser with no lock

The /api/v1/auto_login endpoint mints SUPERUSER tokens for any network caller without authentication. This endpoint exists in Langflow for legitimate purpose — it supports automatic login in development and testing environments where requiring authentication on every startup would slow iteration. In a properly hardened production deployment it should be disabled or restricted. In a default deployment it is active, reachable, and unauthenticated.

An attacker sends a single HTTP GET or POST request to /api/v1/auto_login on any internet-exposed Langflow instance. The endpoint responds with a valid SUPERUSER bearer token. No username. No password. No API key. No prior knowledge of the Langflow installation. Any IP address on the internet receives the same SUPERUSER token that the Langflow administrator uses. This token grants full administrative data-plane access to the Langflow instance — including the ability to read all stored flows, modify them, and call any API endpoint the service exposes.

Endpoint 2: /api/v1/validate/code — the Python executor

The /api/v1/validate/code endpoint then executes attacker-supplied Python via exec(). This endpoint exists for legitimate purpose as well — it allows Langflow’s code component to validate Python snippets that users write as part of custom flow logic. In Langflow’s architecture, users can write Python code that runs as part of their AI agent workflows. The validate/code endpoint is how Langflow tests whether those snippets are valid before incorporating them into a flow.

The problem: it executes the submitted Python directly via Python’s exec() function using the SUPERUSER context established by the auto_login token. An attacker who has a SUPERUSER token from step 1 submits arbitrary Python code to /api/v1/validate/code. That code executes on the Langflow host with the full permissions of the Langflow service process. The attacker has arbitrary code execution on the host.

What arbitrary Python execution on a Langflow host means

Langflow is not a generic web application — it is specifically an AI agent workflow orchestration platform. What lives on a Langflow host, and in the flows stored on it, is categorically more valuable to attackers than what lives on a typical web server:

• Model provider API keys: Every Langflow flow that calls OpenAI, Anthropic, Google Gemini, Mistral, or any other model provider stores that provider’s API key in the flow configuration. An attacker with code execution can extract every API key for every model provider in every flow. These keys provide direct access to the AI capabilities the organization is paying for — and depending on the provider, may have access to fine-tuned models, organizational data, and usage history.
• Database credentials: Langflow flows that connect to databases — for RAG (retrieval-augmented generation), memory storage, or data lookup — store database connection strings including credentials. Code execution gives the attacker access to every connected database the flows are authorized to reach.
• The AI agent logic itself: The flows stored in Langflow encode the organization’s AI agent architecture — which models they use, what system prompts they run, what tools the agents have access to, and how agent decisions are made. This is intellectual property and operational intelligence.
• Downstream service access: Langflow flows that integrate with Slack, GitHub, Jira, email, or any other service via API store those services’ credentials or OAuth tokens. Code execution on the Langflow host provides lateral movement paths into every service the organization’s AI agents are authorized to use.

The DeepSeek/Hermes Agent connection — AI exploiting AI infrastructure

The third CVE added to CISA’s KEV today — Apache Tomcat CVE-2026-34486 — introduces a dimension that makes the full August 5 KEV batch more significant than any individual CVE. The exploitation of CVE-2026-34486 has been attributed to an AI-enabled autonomous hacking campaign orchestrated by a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan. The threat actor, based in Zhuhai, China, is said to have leveraged DeepSeek, via the Hermes Agent framework, as an offensive operator to target internet-exposed systems.

This is the same Chinese DeepSeek agent threat actor DataWater flagged in today’s news roundup — now confirmed with names, location, and the specific CVE they weaponized. The DeepSeek/Hermes Agent framework is the intentional offensive deployment of an open-source frontier AI model as an autonomous attack operator. Unlike the OpenAI ExploitGym incident (accidental containment failure) and the Anthropic disclosure (misconfiguration during evaluation), this is a deliberately constructed offensive AI framework specifically designed to find and exploit vulnerable internet-facing systems autonomously.

The intersection with Langflow CVE-2026-9198 is the attack surface overlap: Langflow is AI agent infrastructure. The DeepSeek/Hermes Agent is an AI agent attack tool. An AI agent attack tool autonomously finding and exploiting AI agent workflow infrastructure is the convergence DataWater has tracked all year — from JADEPUFFER (AI agent ransomware) through ExploitGym (AI agent sandbox escape) through the Anthropic disclosure (AI agents breaching organizations during evaluation) to today: a confirmed Chinese threat actor using an autonomous AI agent framework to exploit CVEs in real-time, with CISA KEV confirmation.

Langflow’s KEV history — this is not the first time

CVE-2026-9198 is the second Langflow CVE in CISA’s KEV catalog. On July 7, 2026, CISA added CVE-2026-55255 — a cross-tenant insecure direct object reference in Langflow’s flow execution endpoint that allowed authenticated attackers to execute any other user’s flows without authorization. The pattern across both KEV entries is the same: Langflow’s API layer was built for developer convenience and iterative workflow, not for the security requirements of a production-deployed, internet-facing AI agent orchestration platform. The auto_login endpoint that powers CVE-2026-9198 is a development convenience feature that was never adequately restricted for production. The flow execution endpoint that powered CVE-2026-55255 performed no ownership validation. Both are architectural choices that prioritized ease of use over security boundaries.

The broader context: Langflow is the most widely deployed open-source AI agent workflow builder in the enterprise market. Its popularity is exactly what makes these vulnerabilities significant at scale. Thousands of organizations have deployed Langflow to build internal AI agent pipelines, RAG systems, and LLM-powered automation — many of them internet-exposed, most of them with real model provider credentials and database access stored in flows. Every one of those deployments running a pre-1.10.1 version is a full-compromise target for anyone who runs a two-request exploit chain.

Immediate actions

1. Upgrade to Langflow 1.10.1 now. This is the only complete fix. All versions 1.0.0 through 1.10.0 are affected.
2. Verify the fix works by confirming /api/v1/auto_login returns 401 to unauthenticated requests after upgrading.
3. Rotate every credential stored in Langflow flows on any instance that was running a pre-1.10.1 version while internet-exposed: all model provider API keys (OpenAI, Anthropic, Google, Mistral, etc.) · all database connection strings · all webhook secrets · all OAuth tokens. Treat every stored credential as compromised until rotated.
4. Remove Langflow from direct internet exposure. Place it behind an authenticating reverse proxy (nginx + OAuth2 proxy, or equivalent) or restrict access to VPN/internal network only. AI agent workflow builders should never be directly internet-accessible.
5. Block /api/v1/auto_login and /api/v1/validate/code at your WAF or reverse proxy as an emergency mitigation if you cannot patch immediately.
6. Conduct forensic triage per CISA’s KEV entry requirement: new cron jobs, new SSH authorized keys, unexpected outbound connections, new OS user accounts, modified flow definitions, unexpected API calls from Langflow’s service account.
7. Audit all flows for credential exposure: review which model provider keys and database credentials are stored in flows, confirm they match expected values, rotate anything that may have been accessed.
8. Check for the July 7 KEV entry (CVE-2026-55255) as well — if you haven’t patched that one either, upgrade to 1.10.1 closes both.

Sources and further reading

• CISA KEV Catalog — CVE-2026-9198 Entry (Primary, August 5, 2026)
• SecurityWeek — “CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities” (Two-Endpoint Chain Confirmed)
• The Hacker News — “CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited” (DeepSeek/Hermes Agent Attribution)
• SentinelOne — CVE-2026-9198 Full Technical Analysis (API Endpoint Details, Remediation Steps)
• CIRCL Vulnerability Lookup — CVE-2026-9198 (Full CVSS Vector, Related CVEs in Same Version Range)
• TechTimes — “CISA Adds First AI Agent Platform to KEV” (Prior Langflow KEV Context, CVE-2026-55255)

DataWater publishes daily cybersecurity intelligence for enterprise and government security leaders. Article #54 — August 5, 2026. Previous: Pass-ta-key (August 4) · Anthropic Disclosure (August 2) · CosmosEscape (July 31). Full archive →