The exploit for CVE-2026-9198 is two HTTP requests. There is no password, no user interaction, and no prior access.
Request one hits /api/v1/auto_login, which mints a SUPERUSER token for any caller that can reach the port. Request two hands attacker-supplied Python to /api/v1/validate/code, which passes it to exec(). The result is arbitrary code execution with full administrative privileges on a default deployment.
CISA confirmed active exploitation on 4 August 2026 and added the flaw to the Known Exploited Vulnerabilities catalogue. The CVSS score is 9.8. Affected versions run from 1.0.0 through 1.10.0; the fix landed in 1.10.1 in July 2026.
Why an unauthenticated superuser endpoint exists at all
auto_login is not a backdoor. It is a developer-experience feature: when Langflow runs locally for a single user, forcing a login screen is friction, so the default configuration issues a token automatically.
The defect is that the convenience default survived contact with deployment. A tool designed around "this is on your laptop, you are the only user" gets deployed to a container, the container gets a service port, the port gets exposed to a network segment, and the assumption that made auto-login safe silently stops being true. Nothing in the software notices.
This is CWE-94 (improper control of generation of code) sitting on top of an insecure default, and the combination is what makes it a 9.8 rather than a 7. Either half alone is survivable. exec() behind real authentication is a privilege escalation for existing users. Unauthenticated access to a read-only API is an information disclosure. Together they are unauthenticated RCE.
What an attacker actually gets
Ask what Langflow is for. It is an AI workflow and agent-orchestration tool, which means a working installation holds:
- Model-provider API keys (OpenAI, Anthropic, and whatever else the flows call)
- Database credentials for anything a flow reads or writes
- Connector tokens for SaaS integrations wired into the flows
- Filesystem access to whatever the host can see
- Network position inside your environment
An AI orchestration host is a credential aggregation point by design. Its entire job is to hold the keys to everything else so that flows can call them. RCE there is not a foothold on one server; it is a path to every system that platform was trusted with.
That property is not specific to Langflow. It is true of every agent-orchestration and workflow-automation platform in the category. Langflow is where it got a CVE number this month.
The exploitation timeline is the part to internalise
Telemetry cited in The Hacker News reports 650 exploitation attempts from 244 unique IP addresses across 41 countries, beginning 6 July 2026 — before the CISA KEV listing, and around the time the fix shipped.
Multiple working proof-of-concept exploits are published on GitHub. The exploit is two curl commands; there is no skill barrier and no toolchain to build.
This matches the broader pattern CrowdStrike reported this month: 88% of observed exploitation of vulnerabilities with a public PoC occurred within 48 hours of that PoC's release. A patch that exists is not a patch that is applied, and the window between the two is now measured in hours.
What to do, in order
Find your Langflow instances — including the ones you did not deploy. This class of tool is adopted bottom-up. A data scientist ran it in a notebook environment, a team stood one up for a prototype, someone's Docker Compose file has it. Search your container registries and your running workloads for the image, not just your CMDB for the name.
Check the version and patch to 1.10.1 or later. This is the actual fix.
If you cannot patch immediately, take the port off the network. Bind to localhost, put it behind an authenticating reverse proxy, or firewall it to a management segment. Given that the exploit needs only network reach, network reach is the mitigation.
Assume compromise if it was internet-exposed before you patched. Exploitation started in early July. An instance that was reachable during that window and is running an affected version should be treated as compromised, not merely vulnerable.
Rotate every credential the instance held. This is the expensive part and it is not optional. Model-provider keys, database passwords, connector tokens, and anything in its environment variables.
Check for persistence. RCE as superuser means flows may have been added or modified. Review the flow definitions themselves, not just the process list.
The generalisable lesson
Treat AI orchestration platforms as production infrastructure with production controls. The industry has spent a decade learning to put authentication in front of Jenkins, Airflow, and Kubernetes dashboards. The AI workflow tooling adopted in the past two years is at the same maturity stage those tools were at ten years ago, with a richer credential store and a faster adoption curve.
Specifically: any tool whose purpose is to run code you supply is a code-execution service. Langflow's validate/code endpoint is doing exactly what it was built to do. The security boundary was supposed to be authentication, and the default configuration removed it.
How Safeguard helps
Inventory that includes the tools nobody registered. Safeguard's Supply Chain Core inventories containers, packages, models, and MCP servers into one continuous CycloneDX and SPDX SBOM. The reason CVE-2026-9198 will linger in most estates is not that patching is hard — it is that nobody has a complete list of where Langflow is running. Safeguard turns "do we run this" into a query with an answer.
KEV-aware prioritisation instead of CVSS sorting. A 9.8 with confirmed in-the-wild exploitation and a public PoC is categorically different from a 9.8 nobody has ever exploited. Safeguard weights CISA KEV membership, exploit availability, and EPSS alongside CVSS and reachability, so this surfaces above the several hundred other criticals in the backlog.
MCP and AI-agent governance. Safeguard inventories the AI orchestration surface specifically — which agent platforms run where, which MCP servers they connect to, and which credentials each is configured with — and gates tool exposure per-server with feature flags. That inventory is what makes the rotation question answerable when an orchestration host is compromised.
Lion for the credential aggregation problem. The reason RCE on Langflow is catastrophic is that Langflow holds standing, long-lived keys to everything downstream. Lion brokers those secrets just-in-time with capability scoping and egress allowlists, so a compromised orchestration host yields short-lived, narrowly scoped credentials rather than a keyring — and the signed audit trail shows exactly what was requested during the exposure window.
Griffin and Eagle for the response. Eagle scopes which instances were genuinely reachable and which credentials were genuinely exposed. Griffin opens and tests the version-bump PRs across every repository and manifest that references an affected image.
If you run any AI workflow tool, go and check right now whether its port answers an unauthenticated request. That check takes thirty seconds and is the whole vulnerability.
Sources: The Hacker News · CISA KEV Catalog · Indusface · SentinelOne Vulnerability Database · CrowdStrike 2026 Threat Hunting Report
