Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
NVD: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
warncomponent_extraction: Component 'Langflow /api/v1/auto_login endpoint (CVE-2026-9103) and /api/v1/validate/code endpoint (CVE-2026-8481)' matches or contains product name 'Langflow' — no specific component identified
Hunting hypothesis agent
Hunt access logs for POST requests to /api/v1/validate/code whose JSON body contains "def _v(a=exec(" or "subprocess.check_output" (the CVE-2026-9198 exploit pattern), preceded by an unauthenticated /api/v1/auto_login token request.
Research details
ComponentLangflow /api/v1/auto_login endpoint (CVE-2026-9103) and /api/v1/validate/code endpoint (CVE-2026-8481)
PreconditionsNetwork reachability to Langflow API (default port 7860); LANGFLOW_AUTO_LOGIN=true (default in Langflow < 1.5) mints a superuser JWT via GET/POST /api/v1/auto_login with no credentials; /api/v1/validate/code then executes user-supplied Python via exec() with no sandbox. Affected versions: Langflow OSS 1.0.0 through 1.10.0. On Langflow >= 1.5 AUTO_LOGIN must be explicitly enabled. agent
DeliveryHTTP (GET /api/v1/auto_login then POST /api/v1/validate/code with JSON body)
Exploit notesPublic PoC available (exploit.py, Python 3.6+ stdlib only) — two-step chain: (1) GET /api/v1/auto_login returns a superuser access_token, (2) POST /api/v1/validate/code with JSON body {"code": "def _v(a=exec('<payload>')): pass"} executes arbitrary Python because exec() runs the default argument at definition time; command output is reflected in the response's function.errors[0] field. The PoC supports single commands, interactive pseudo-shell, and reverse shells. Multiple independent PoCs on GitHub. CVSS 9.8/10.0.
SummaryIBM Langflow OSS (1.0.0–1.10.0) contains an unauthenticated remote code execution chain (CVE-2026-9198) that exploits two flaws present on default deployments: CVE-2026-9103 (auto_login mints superuser JWT to any caller when LANGFLOW_AUTO_LOGIN is enabled, the default before 1.5) and CVE-2026-8481 (validate/code endpoint execs user-supplied Python with no sandbox). The exploit wraps OS commands in a function default argument so exec() runs them at definition time, reflecting output in function.errors[]. Multiple public PoCs (3 repos); vendor advisory CVSS 10.0; frequently runs as root in Docker/systemd deployments.
Tia coverage
First reported2026-09-08
First exploit report2026-08-06
Exploit report → KEV2 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.