CVE-2026-9198

🗓️ 17 Jul 2026 17:36:11Reported by ibmType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

CVE-2026-9198 enables unauthenticated RCE in Langflow 1.0.0–1.10.0 through auto_login and validate/code.

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for CVE-2026-9198	24 Jul 202609:29	–	githubexploit
GithubExploit	Exploit for CVE-2026-9198	21 Jul 202611:14	–	githubexploit
GithubExploit	Exploit for Code Injection in Langflow	24 Jul 202620:50	–	githubexploit
ATTACKERKB	CVE-2026-9198	17 Jul 202617:36	–	attackerkb
BDU FSTEC	Vulnerability of components /api/v1/validate/code and /api/v1/auto_login in the software for visual development of IBM Langflow OSS AI agents, allowing a perpetrator to execute arbitrary code.	22 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-9198	17 Jul 202618:18	–	circl
Cvelist	CVE-2026-9198 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation	17 Jul 202617:36	–	cvelist
IBM Security Bulletins	Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation	2 Jul 202619:29	–	ibm
EUVD	EUVD-2026-45236	17 Jul 202617:36	–	euvd
NCSC	Vulnerabilities handled in IBM Langflow OSS	21 Jul 202609:42	–	ncsc

NVD

Vulners

Node

langflow langflowRange1.0.0–1.10.1

[
  {
    "vendor": "IBM",
    "product": "Langflow OSS",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThanOrEqual": "1.10.0",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:langflow_oss:1.10.0:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7278927

Parameter	Position	Path	Description	CWE
code	request body	/api/v1/validate/code	Endpoint that executes attacker-controlled Python code (code execution)	CWE-94

24 Jul 2026 16:57Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.19.8

EPSS0.00443

SSVC

CWE-94