CISA Flags Langflow, Tomcat, and N-central Flaws as Actively Exploited (CVE‑2026‑9198, CVE‑2026‑34486, CVE‑2026‑18556)

What Happened

On August 5, 2026 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three flaws to its Known Exploited Vulnerabilities (KEV) catalog. The agency cited active exploitation in the wild for each entry:

• CVE‑2026‑9198 (CVSS 9.8) – unauthenticated remote code execution in the AI workflow platform Langflow.

• CVE‑2026‑34486 (CVSS 7.5) – missing encryption in Apache Tomcat that bypasses the EncryptInterceptor cluster component.

• CVE‑2026‑18556 (CVSS 8.2) – authentication‑bypass in N‑able N‑central (partial fix later issued as CVE‑2026‑18577).

All three products are widely deployed in enterprise environments, making the combined threat surface massive.

Technical Analysis

Langflow RCE (CVE‑2026‑9198) stems from an insecure exec_globals parameter in the /validate endpoint. The backend deserializes untrusted user input via pickle.loads(), allowing attackers to execute arbitrary Python code without authentication. Affected versions range from 0.0.31 to 1.7.3; the issue was patched in 1.10.1 (July 2026). The KEV Intel service logged >220 exploitation attempts from 64 unique IPs starting June 27, 2026.

Tomcat Encryption Bypass (CVE‑2026‑34486) affects Apache Tomcat 9‑0‑117, 10‑1‑54, and 11‑0‑21. The EncryptInterceptor is intended to encrypt inter‑node messages, but a missing check allows crafted traffic to skip encryption entirely, exposing cluster communication to eavesdropping and tampering. This vulnerability was leveraged by a China‑based threat actor (aliases knaithe/KnYuan) using DeepSeek‑driven autonomous hacking to target internet‑exposed Tomcat instances.

N‑central Auth Bypass (CVE‑2026‑18556 / CVE‑2026‑18577) is an unauthenticated bypass of the web UI authentication flow, allowing attackers to obtain administrative sessions. The initial fix (CVE‑2026‑18556) was incomplete, prompting N‑able to release CVE‑2026‑18577 as a corrective patch. Both CVEs are now listed in KEV, indicating active exploitation.

Who’s Affected

Enterprises running any of the following are at risk:

• Langflow deployments (often containerised AI pipelines) – especially those exposing the default /validate endpoint.

• Apache Tomcat clusters in production (webapps, middleware, micro‑services).

• N‑central remote‑management installations used by MSPs and internal IT teams.

Combined, these products protect billions of requests daily; a successful exploit can lead to full system compromise, credential theft, or lateral movement across internal networks.

How to Protect Yourself

1. Patch Immediately: Apply the latest Langflow 1.10.1 release, upgrade Tomcat to 9.0.118, 10.1.55, or 11.0.22, and install N‑central 2026‑18577 patches.

2. Restrict Network Exposure: Block external access to Langflow validation endpoints and Tomcat cluster ports behind a firewall or VPN. Use zero‑trust network segmentation.

3. Enable TLS & Authentication: Ensure Tomcat’s EncryptInterceptor is enabled with strong cipher suites, and enforce MFA on N‑central admin consoles.

4. Monitor for Exploitation Indicators: Look for unusual outbound connections from Langflow containers, unexpected Java deserialization errors in Tomcat logs, and anomalous admin‑session creations in N‑central.

5. Perform Post‑Patch Validation: Run vulnerability scanners (e.g., OpenVAS, Nessus) to confirm the patches are applied and no residual exploit code remains.

The Sable Angle

At Sable we specialise in hardening AI‑powered pipelines and legacy Java stacks. Our Langflow security audit uncovers hidden deserialization paths, and we can assist with automated Tomcat cluster hardening via our bespoke SecureCluster module. Contact us for a free triage of your AI‑workflow and Java infrastructure.