Cybersecurity

Langflow's Two-Call Chain Handed Root to 295 Attackers

CVE-2026-9198 chains two Langflow API calls into unauthenticated root access. CISA confirmed active exploitation; 756 attempts from 295 IPs logged by August 12. Why shadow AI tooling is the real gap.

CybersecurityBy Servola Tech Desk2026-08-134 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Langflow's Two-Call Chain Handed Root to 295 Attackers

Key takeaways

CVE-2026-9198 lets an unauthenticated attacker chain two Langflow API endpoints into full remote code execution with a single request; CISA confirmed active exploitation and telemetry firm KEVIntel had logged 756 attempts from 295 unique IP addresses across 42 countries by August 12, so any exposed instance should be treated as already compromised, not merely at risk.
IBM, which now maintains the open-source Langflow project, disclosed and patched the flaw the same day, July 17, 2026, in version 1.10.1, but a public proof-of-concept landed four days later and CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 4.
Langflow is a low-code platform for building AI agent workflows, which means most exposed instances were not deployed by central IT but by product or data teams prototyping quickly - the kind of shadow AI infrastructure that never makes it into an asset inventory.
A missing asset inventory entry is not a technicality under NIS2 Article 21: if security teams do not know an instance exists, the patch that closed this hole three weeks ago never reaches it, and the exposure continues indefinitely.
The fix is a version upgrade, not a redesign, which makes this a rare case where full remediation is cheap - the harder and more durable task is finding every Langflow instance a business unit spun up without telling anyone.

A Two-Call Chain Turns Default Langflow Into Root

CVE-2026-9198 is a code injection flaw in Langflow, the open-source platform teams use to visually build AI agent workflows, and it carries a CVSS score of 9.8 out of 10. The path to full compromise takes exactly two requests. The first hits an endpoint called /api/v1/auto_login, which on a default deployment is not restricted to the local machine and hands out a SUPERUSER authentication token to any caller on the network, no credentials required. The second request uses that token against /api/v1/validate/code, an endpoint that runs attacker-supplied Python through the language's own exec() function.

IBM, which acquired stewardship of the Langflow project and maintains it as Langflow OSS, disclosed the vulnerability and shipped version 1.10.1 with the fix on the same day, July 17, 2026. Versions 1.0.0 through 1.10.0 are affected. There is no partial mitigation short of the upgrade: because the flaw sits in unauthenticated default behaviour, restricting network access to the Langflow host is the only interim control that actually closes the door.

756 Attempts, 295 Attackers, 42 Countries by August 12

A public proof-of-concept for the exploit chain went live on July 21, 2026, four days after the patch shipped, and exploitation accelerated from there. Vulnerability intelligence firm KEVIntel, which runs sensors specifically to catch real-world attack traffic against catalogued flaws, recorded 756 exploitation attempts from 295 unique attacker IP addresses spread across 42 countries in the period from July 6 through August 12, 2026.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4, confirming the activity was not scanning noise but genuine compromise attempts. The vulnerability's EPSS score, a model that predicts the probability of exploitation in the next 30 days, sits at 17.4 percent - itself a meaningful figure for a flaw with a public PoC, since most catalogued CVEs never reach double digits.

Why a Prototyping Tool Ended Up Facing the Internet

Langflow was built to make it fast for a non-specialist to wire an LLM into a working agent without writing much code, and that is exactly why it spreads the way it does inside a company. A data scientist or a product manager can stand up an instance on a laptop, a shared server, or a cloud VM in an afternoon to test an idea, with no ticket filed against central infrastructure and no line item in a security register.

That pattern is what security teams are increasingly calling shadow AI: tooling that exists to serve a real, often legitimate business need, deployed outside the change-management and asset-inventory processes that would normally flag it for patching the moment a CVE like this one lands. The 295 attacker IP addresses observed by KEVIntel did not need a target list. Langflow's default auto_login behaviour is scannable at internet scale, and an instance nobody remembers standing up is exactly the kind that never gets the memo.

What This Means for the Next Patch Cycle, Not Just This One

For any EU or UK organisation working through NIS2 Article 21 risk-management obligations, the operative lesson is not the CVE itself, since the fix is a one-line version bump. It is that the article's requirement to maintain visibility over network and information systems has to extend to instances that business teams, not IT, brought online. A national CSIRT can only add a flaw like this to guidance it publishes; it cannot inventory a company's shadow AI footprint for it.

The practical response this week is threefold: run an external scan for exposed /api/v1/auto_login endpoints across every subnet and cloud account the organisation controls, not just the ones IT already tracks; upgrade every Langflow instance found to 1.10.1 or later; and treat this incident as the trigger to ask every product and data team, directly, what AI tooling they have stood up on their own in the last twelve months.

Frequently asked questions

Is Langflow just a developer toy, or does this affect production systems?

Both. Langflow started as a rapid-prototyping tool, but many of those prototypes get wired directly into production agent pipelines without ever being re-platformed, which is exactly why an unauthenticated root-access flaw in it matters well beyond a test lab.

If we already upgraded to 1.10.1, are we fully protected?

The upgrade closes the exploit path, but it does not undo any access an attacker may have already gained. Given exploitation attempts were logged from July 6 onward, organisations that ran an affected version during that window should review logs for unexpected calls to /api/v1/auto_login and /api/v1/validate/code before the patch was applied.

Is this part of a wider pattern in AI agent tooling, or a one-off bug?

It fits a pattern security researchers have flagged repeatedly through 2026: platforms built to make agent development fast tend to ship permissive defaults, and those defaults become internet-scale attack surface the moment a proof-of-concept goes public. Langflow is a prominent example, not an isolated one.

The patch for CVE-2026-9198 cost IBM one day and users one version upgrade. The part that will not be fixed by Friday is knowing which of your business units already installed Langflow without telling anyone. That inventory gap, not the CVE, is the actual finding here.

LangflowCVE-2026-9198CISA KEVshadow AINIS2IBM

An AI Agent Ran This Whole Ransomware Attack

Researchers documented JadePuffer, the first ransomware attack run end to end by an AI agent. The way in was a self-hosted AI tool a year behind on a patch.

4 min read

Cybersecurity

Three Days to Patch the AI Builder Nobody Logged

CISA added Langflow flaw CVE-2026-0770 on 21 July 2026: CVSS 9.8, unauthenticated code execution as root. Why this is an inventory problem in patch clothing.

3 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.