CVE-2026-9198: IBM Langflow Code Injection Vulnerability

EPSS trend

Probability

28.66%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

-31.94 pp

From 60.60% on 21-09-2026

21-09-202621-10-2026

EPSS score

28.66%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 04-08-2026
Federal due date: 07-08-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. www.ibm.com/support/pages/node/7278927 nvd.nist.gov/vuln/detail/CVE-2026-9198

Public exploits

2 found

MetasploitremoteVerified
Langflow AI auto_login RCE
exploit/multi/http/langflow_unauth_rce_cve_2026_9198
Maturity: weaponized
exploit-databasemultipleUnverified
Langflow 1.10.0 - RCE
Maturity: poc

References

2 links

www.ibm.com/support/pages/node/7278927Vendor AdvisoryPatch
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198Government ResourceUS Government Resource

Related vulnerabilities

CVE-2026-107366ibmlangflow oss0.22%2d ago19-10-2026 23:49IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.CVE-2025-57760langflow-ailangflow+30.52%1y ago25-08-2025 16:22Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. A patched version has not been made public at this time.CVE-2025-3248langflow-ailangflow+3KEVRansomware99.99%1y ago07-04-2025 14:22Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.CVE-2024-42835langflowlangflow+11.16%1y ago31-10-2024 00:00langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.CVE-2024-48061langflowlangflow+11.54%1y ago04-11-2024 00:00langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.CVE-2024-9277langflowlangflow+10.96%2y ago27-09-2024 11:00A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

All vulnerabilities inlangflow oss langflow

CVE-2026-9198: IBM Langflow Code Injection Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References