Threat · curated 8 Jul 2026
IBM's agentic AI platform is under active attack - patch now
First reported · updated · 4 reports cve.org
Coverage timeline
Why it matters
Langflow is a widely used builder for agentic and RAG workflows, integrated into IBM watsonx.ai, so an unauthenticated internet-sprayable RCE gives attackers full takeover of servers orchestrating AI agents and their credentials.
A critical vulnerability, CVE-2026-9198, in IBM-owned low-code AI agent builder Langflow lets unauthenticated attackers achieve remote code execution on default deployments by chaining an auto-login endpoint that mints superuser tokens with a code-validation endpoint that runs arbitrary Python. CISA added it to its Known Exploited Vulnerabilities catalog after confirming active exploitation; IBM says Langflow OSS 1.0.0 through 1.10.0 are affected and urges upgrading to 1.10.1 or later. Sysdig telemetry documents in-the-wild attack chains (including related CVE-2026-33017 RCE and CVE-2026-55255 IDOR) that probe /api/v1/auto_login, enumerate flows, and deliver second-stage loaders.
Summary
CVE-2026-9198 is a critical vulnerability in IBM-owned Langflow, a low-code/no-code AI agent builder, that allows unauthenticated attackers to execute code remotely on default deployments. CISA added it to its Known Exploited Vulnerabilities catalog after identifying evidence of active exploitation and urged organizations to apply IBM's mitigation guidance immediately.[0]
The flaw chains two weaknesses present in default deployments: an auto-login endpoint that mints superuser tokens to any network caller, and a code validation endpoint that will run any Python code submitted to it. Combined, these give an unauthenticated network attacker full remote code execution over the Langflow server. IBM says the vulnerability affects Langflow OSS 1.0.0 through 1.10.0 and recommends upgrading to 1.10.1 or later (latest is 1.11.2).[0]
The CVE was published on July 17, 2026, and exploitation followed quickly, illustrating how default configuration deployments — an exposed auto-login endpoint plus an accessible code validation endpoint — can be a disaster. Langflow is now integrated into IBM's watsonx.ai as middleware following IBM's 2025 acquisition of DataStax.[0]
Separately, Sysdig documented earlier in-the-wild Langflow exploitation that chained the IDOR CVE-2026-55255 with the code-injection RCE CVE-2026-33017, delivering a second-stage loader from a single C2 (45.207.216.55) and writing an execution marker /tmp/lang_pwn — a reminder that Langflow's exposed, unauthenticated API surface has been repeatedly targeted.[38]
Attack chain
- Superuser token acquisition (auto-login): An unauthenticated network caller reaches the auto-login endpoint present in default Langflow deployments, which mints superuser tokens to any caller.[0]
- Arbitrary code execution (code validation endpoint): Using the easily obtained superuser rights, the attacker submits arbitrary Python to a code validation endpoint that executes it, yielding full takeover of the Langflow server (CVE-2026-9198).[0]
- Sysdig-observed IDOR-to-RCE chain (separate activity): In earlier Langflow activity Sysdig observed health/auto_login probing, flow enumeration via /api/v1/flows/, IDOR exploitation of CVE-2026-55255, and code-injection RCE CVE-2026-33017 (POST /api/v1/build_public_tmp/ /flow) that shelled out via curl/wget piped to sh to fetch a loader from 45.207.216.55:8084 and wrote /tmp/lang_pwn.[38]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-06-25 | Sysdig observed in-the-wild Langflow exploitation chaining IDOR CVE-2026-55255 and RCE CVE-2026-33017, including flow enumeration and roughly four RCE waves with two attempted outbound connections to 45.207.216.55:8084.[38] |
| 2026-07-17 | CVE-2026-9198 was published.[0] |
| 2026-08-04 | CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog after identifying evidence of active exploitation, urging organizations to apply IBM's mitigation guidance.[0] |
How it works
CVE-2026-9198 enables unauthenticated remote code execution on default Langflow deployments by chaining two issues: an auto-login endpoint that mints superuser tokens to any network caller, and a code validation endpoint that executes arbitrary Python code submitted to it. Together these let a network attacker obtain superuser rights and then run code on the server.[0]
In separately documented Langflow activity, Sysdig showed the IDOR CVE-2026-55255 at /api/v1/responses is inert on its own and depends on the oversharing /api/v1/flows/ listing to disclose victim flow UUIDs; in practice it was paired with the unauthenticated code-injection RCE CVE-2026-33017 (POST /api/v1/build_public_tmp/ /flow) that shelled out via curl/wget piped to sh to fetch a second-stage loader.[38]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| IBM Langflow OSS (low-code AI agent builder) | Versions 1.0.0 through 1.10.0 in default deployments are affected by CVE-2026-9198 (unauthenticated RCE). | Fixed in 1.10.1 or later; IBM recommends upgrading and the most recent release is 1.11.2. Actively exploited and added to CISA KEV on August 4, 2026.[0] |
| Langflow (Sysdig-observed exploitation) | Instances exposing the /api/v1/flows/ listing and /api/v1/build_public_tmp/ endpoints, exploited via IDOR CVE-2026-55255 and code-injection RCE CVE-2026-33017. | Observed exploited in the wild in June 2026 per Sysdig telemetry.[38] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| ip | 45.207.216.55 | Single source IP and C2 in Sysdig-observed Langflow exploitation; hosts the second-stage loader on port 8084 (hxxp://45.207.216.55:8084/slt) and received outbound RCE connection attempts.[38] |
| other | JA4 TLS fingerprint t13i1f0a00_e8f1e7e78f70_1f22a2ca17c4 | Constant TLS fingerprint across the Sysdig-observed attack session, usable as a detection indicator.[38] |
| file-path | /tmp/lang_pwn | Execution marker written by the injected loader, indicating successful Langflow RCE and implant execution.[38] |
| cve | CVE-2026-9198 | Critical Langflow unauthenticated RCE via chaining an auto-login superuser-token endpoint with a code validation endpoint; actively exploited and added to CISA KEV. Affects Langflow OSS 1.0.0–1.10.0.[0] |
| cve | CVE-2026-55255 | IDOR at /api/v1/responses used in Sysdig-observed Langflow exploitation; inert alone, requires the oversharing /api/v1/flows/ listing to disclose victim flow UUIDs.[38] |
| cve | CVE-2026-33017 | Unauthenticated code-injection RCE (POST /api/v1/build_public_tmp/ /flow) chained by attackers in Sysdig-observed Langflow exploitation to fetch a second-stage loader.[38] |
Key takeaways
- Default configuration deployments are the core failure here: an unauthenticated auto-login endpoint that mints superuser tokens plus an exposed code validation endpoint combine into full RCE, so hardening or restricting default endpoints is as important as patching.[0]
- Langflow's exposed, unauthenticated API surface has been repeatedly targeted — CVE-2026-9198 is now KEV-listed and under active attack, while Sysdig documented a separate IDOR-to-RCE chain (CVE-2026-55255 and CVE-2026-33017) delivering a loader from a single C2.[0][38]
Defensive actions
- Upgrade Langflow OSS to 1.10.1 or later (ideally the latest 1.11.2) and apply IBM's mitigation guidance: CVE-2026-9198 affects default deployments of Langflow OSS 1.0.0–1.10.0 and is actively exploited; IBM's fix and CISA's KEV listing call for prompt upgrade.[0]
- Restrict network exposure of the Langflow auto-login and code validation endpoints: The RCE chain relies on an auto-login endpoint minting superuser tokens to any network caller and an accessible code validation endpoint running arbitrary Python; limiting network reachability of these default endpoints removes the attack path.[0]
- Hunt for the Sysdig-published Langflow exploitation indicators: The C2 IP 45.207.216.55 (loader on port 8084), the constant JA4 fingerprint, and the /tmp/lang_pwn execution marker enable detection of the IDOR-to-RCE chain that has targeted exposed Langflow instances.[38]
Changelog
- Added specific CVE-2026-9198 mechanism detail: the RCE chain combines an auto-login endpoint that mints superuser tokens to any network caller with a code validation endpoint that executes arbitrary Python code on default deployments.[0]
- Added affected-version scope for CVE-2026-9198: Langflow OSS 1.0.0 through 1.10.0, fixed in 1.10.1 or later (latest 1.11.2), and the CVE publication date of July 17, 2026.[0]