IBM Langflow OSS Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-9198)

1. Apply Official Patch

Upgrade your Langflow installation to the latest secure version (1.10.1 or higher):

pip install --upgrade langflow

2. Temporary Mitigations

• Disable Auto-Login: Force authentication by setting the following environment variable to false:

  export LANGFLOW_AUTO_LOGIN=False

• Network Segmentation: Ensure the Langflow service port (default: 7860) is not exposed to the public internet. Restrict access using firewalls, security groups, or VPNs.
• WAF Rules: Implement Web Application Firewall (WAF) rules to block external requests targeting /api/v1/auto_login and /api/v1/validate/code endpoints.

This vulnerability is a critical Remote Code Execution (RCE) exploit chain resulting from two distinct flaws in IBM Langflow OSS:

• Authentication Bypass: The /api/v1/auto_login endpoint is exposed by default, allowing any unauthenticated network caller to mint a high-privilege SUPERUSER token.
• Code Injection: Using the acquired token, attackers can access the /api/v1/validate/code endpoint, which executes arbitrary user-supplied Python code via the unsafe exec() function.

By chaining these two endpoints, an unauthenticated remote attacker can achieve full remote code execution on default Langflow deployments. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.