EXPLOIT-CVE-2026-9198

CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of-concept exploit and a self-contained Docker lab for CVE-2026-9198 , an unauthenticated remote code execution vulnerability in IBM Langflow OSS. The exploit chains two endpoints — autologin which hands out a SUPERUSER token to anyone an...

Langflow 1.x.x < 1.10.1 Code Injection

The version of Langflow installed on the remote host is 1.x.x prior to 1.10.1. It is, therefore, affected by a code injection vulnerability: - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with...