Langflow OSS - Superuser Token Issuance

Langflow OSS with default AUTOLOGIN exposes /api/v1/autologin, which returns a superuser access token to any unauthenticated request. id: CVE-2026-9103 info: name: Langflow OSS - Superuser Token Issuance author: str4k3r severity: critical description: | Langflow OSS with default AUTOLOGIN exposes...

EXPLOIT-CVE-2026-9198

CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of-concept exploit and a self-contained Docker lab for CVE-2026-9198 , an unauthenticated remote code execution vulnerability in IBM Langflow OSS. The exploit chains two endpoints — autologin which hands out a SUPERUSER token to anyone an...

CVE-2026-9198_exploit

CVE-2026-9198 — Langflow OSS Unauthenticated RCE Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 – 1.10.0 on a default deployment. Chains two flaws: CVE-2026-9103 — GET /api/v1/autologin mints a SUPERUSER JWT to any caller with no credentials whenever AUTOLOGIN is enabled the...

CVE-2026-0770

🚀 CVE-2026-0770 – Langflow RCE execglobal PoC Remote Code Execution vulnerability in Langflow 📌 Affected Software This vulnerability affects: Langflow 🧠 Vulnerability Overview CVE-2026-0770 is a Remote Code Execution RCE vulnerability in the: /api/v1/validate/code endpoint. When AUTOLOGIN=true an...

Exploit for Code Injection in Langflow

CVE-2026-9198: Langflow unauthenticated remote code execution...

EUVD-2026-92788

Langflow: OS command injection RCE via arbitrary command in MCP stdio server configuration...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

Exploit for Code Injection in Langflow

CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of...

Langflow 1.10.0 Remote Code Execution

Langflow versions 1.10.0 and below are susceptible to unauthenticated remote code execution. By chaining /api/v1/autologin with /api/v1/validate/code, a remote unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. frozenstringliteral: true This module requires...

Exploit for Code Injection in Langflow

CVE-2026-9198 - IBM Langflow OSS Unauthenticated Remote Code...

Langflow auto_login + validate/code Chain Unauthenticated RCE (CVE-2026-9198) (Direct Check)

Binary data langflowautologinvalidatecodercecve20269198.nbin...

Langflow 1.x.x < 1.10.1 Code Injection

The version of Langflow installed on the remote host is 1.x.x prior to 1.10.1. It is, therefore, affected by a code injection vulnerability: - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with...

CVE-2026-9103

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...

CVE-2026-9198

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with /api/v1/validate/code executes user code via exec to achieve full RCE on default Langflow deployments...

CVE-2026-9103: Missing Authentication for Critical Function

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...

CVE-2026-9198: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with /api/v1/validate/code executes user code via exec to achieve full RCE on default Langflow deployments...

Langflow AI auto_login RCE

Langflow versions 1.10.0 and below are susceptible to unauthenticated remote code execution. By chaining /api/v1/autologin with /api/v1/validate/code, a remote unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. Module Options msf use...

EUVD-2014-9559

Malware in sbrugna...

CVE-2025-6813 aapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function

The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the autologin function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gai...