Langflow CVE-2026-9198: Active Exploitation RCE via Auto-Login Superuser Token and Code Validator exec() Chain

1. Basic Information

• Article Title: CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
• Publisher: BleepingComputer
• Publication Date: August 5, 2026
• Source: BleepingComputer
• Primary / Related Sources: CISA KEV Catalog, IBM Security Bulletin
• Related CVE: CVE-2026-9198
• Affected Products: Langflow OSS 1.0.0 to 1.10.0, AI agent workflow, Python
• Related Malware / Threat Groups: CISA confirmed active exploitation, but specific campaigns, malware, and threat groups are not disclosed
• Severity: Critical

IBM published technical details on July 2, 2026. The new development is that CISA confirmed active exploitation and added the flaw to the KEV catalog on August 5, 2026. N-central and Apache Tomcat are covered in other reports or previous Unit 42 cases, so this report focuses only on Langflow.

2. One-Sentence Summary

This is a two-stage RCE. An attacker gets a SUPERUSER bearer token without authentication from the enabled-by-default /api/v1/auto_login endpoint, and then sends Python decorators, default arguments, and annotations to /api/v1/validate/code using that token to trigger exec() during definition time, executing OS commands with Langflow process privileges.

3. Attack Flow

Chain A: Authentication Bypass to Python RCE

1. The attacker finds a network-accessible Langflow instance.
2. The attacker sends an unauthenticated request to GET /api/v1/auto_login.
3. The endpoint issues a SUPERUSER bearer token to any network caller.
4. The attacker sends a malicious Python function definition with the token to POST /api/v1/validate/code.
5. The validator runs exec() instead of only doing safe parsing and compilation.
6. Decorators, default arguments, and annotations evaluate during function definition.
7. Arbitrary commands execute with Langflow backend process privileges.

Chain B: Expected Scope After Compromise

1. LLM provider API keys and database credentials can be stolen from the process environment.
2. Flow definitions, stored credentials, and vector store connectors can be explored.
3. The attacker can modify the filesystem, add payloads, or move to the internal network.
4. If the default container runs as root, the impact on the host and container is maximized.

Chain B is an inference based on the technical impact of the CVE. CISA has not publicly released the specific follow-up actions of the active attacks it confirmed.

4. Attacker Position and Execution Location

• Attacker: Reaches the Langflow HTTP API from the internet or an internal network.
• Authentication Bypass: Langflow backend auto-login endpoint.
• Code Execution: Python exec() in the code validation endpoint.
• Execution Location: Langflow service, container, or host.
• Privileges: Langflow process user. Root if using the default container setup.
• Follow-up Targets (Inference): Environment secrets, databases, LLM providers, vector stores, and internal services.

5. Visibility for Victims and Administrators

No user action is required, and the UI may look normal. Administrators and SOCs can spot external access to the auto-login endpoint, subsequent validate/code requests, shell or network connections from the Langflow process, API key usage, and flow changes. A single request looks like normal functionality, so analysts must correlate the token issuer, source IP, and subsequent code validation.

6. Success and Failure Conditions

Success Conditions

• Langflow versions 1.0.0 to 1.10.0.
• Default auto-login is enabled.
• Auto-login and validate/code endpoints are network-reachable by the attacker.
• The process can access OS commands or secrets.
• WAF or API monitoring does not block the two-stage chain.

Failure Conditions

• Upgraded to Langflow 1.10.1 or later.
• Vulnerable endpoints are isolated from the internet and untrusted internal networks.
• A patched version is applied instead of relying only on disabling auto-login.
• Services and containers run as non-root with least privilege and restricted egress.
• Abnormal correlation between token issuance and validate/code requests is blocked.

7. What Happens on Success

An attacker obtains a superuser token without credentials and executes arbitrary Python or OS commands with the same privileges as the Langflow process. They can read and write secrets, flows, credentials, and the filesystem, expanding their impact to AI workflows, connected services, and the internal network. CISA confirmed active exploitation but did not disclose post-compromise activity or the scale of damage.

8. Observable Logs

Email

• No user phishing is required.

Proxy / SWG / DNS

• Requests to /api/v1/auto_login from external sources.
• Requests to /api/v1/validate/code using the same source or token.
• Egress traffic from the Langflow host to new domains or IPs.

Endpoint / EDR

• sh, bash, cmd.exe, PowerShell, or similar shells launched from the Langflow/Python process.
• Python child processes, download tools, and file modifications.
• Access to secret or configuration files by the service account.

Identity / IdP

• SUPERUSER token issuance without credential input.
• Admin API usage immediately after token issuance.
• LLM or cloud API key usage from unusual sources.

SaaS / Cloud

• Creation or modification of Langflow flows and components.
• Abnormal use of LLM provider API keys.
• Access to vector stores, databases, and object storage connectors.
• Container or Kubernetes audits showing exec, secret reads, and egress.

Network

• Two-request exploit pattern.
• New connections from the service to internal RFC1918 or metadata endpoints.
• Reverse shells, payload downloads, and scanning activities.

9. Attack Success Determination

• Contact Only: Langflow fingerprinting and endpoint probing.
• User Action: Not required.
• Auth Bypass Success: SUPERUSER token response returned to an unauthenticated auto-login request.
• Initial Execution: Malicious definition sent to the validate/code endpoint.
• RCE Success: Shells, files, or network side effects confirmed from Langflow/Python.
• Data Theft / Session Compromise: API keys or credentials obtained or used externally.
• Follow-up Compromise: Flow tampering, persistent files, reverse shells, or internal access.

10. Investigation Playbook

Trigger

• Assets affected by CVE-2026-9198 found in the CISA KEV.
• External auto-login requests.
• Sequential access: auto-login followed by validate/code.
• Shell spawned from the Langflow process.

Initial Checks

1. Verify version, deployment method, auto-login settings, and exposure scope.
2. Extract the initial auto-login and token usage from HTTP/API logs.
3. Preserve validate/code payloads, responses, and source IPs.
4. Cross-reference process, container, and cloud audit logs for the same timestamp.

Device / Server

• Langflow/Python child processes, shell history equivalents, and file changes.
• Container layers, volumes, cron jobs, services, and temporary directories.
• Access to environment variables and stored credentials.

Authentication / Cloud

• Revoke issued tokens and sessions.
• Rotate LLM, database, vector store, and cloud credentials within Langflow.
• Check token and API key usage history on the provider side.

Follow-up Operations

• Internal scanning, metadata access, secret reading, and reverse shells.
• Flow or component tampering, new admin/users, and MCP/connector changes.
• Access to other Langflow instances from the same source IP.

Containment

• Isolate the instance from untrusted networks.
• Upgrade to version 1.10.1 or later.
• Rebuild vulnerable containers or hosts after preserving evidence.
• Rotate all connected credentials and API keys.
• Minimize egress and internal reachability.

Judgment Categories

• Vulnerable/Exposed / Exploit Attempt / Superuser Token Issued / Code Execution Confirmed / Secret Compromise Confirmed / Internal Follow-on Confirmed

11. Defense and Detection Ideas

Single Events

• /api/v1/auto_login requested from an internet source.
• SUPERUSER token issued to an unauthenticated request.
• Shell spawned from the Langflow process.

Time-Series Correlation

External auto_login → SUPERUSER token → validate/code → Python exec → shell/egress/secret access

Hunting Perspectives

• Use of admin APIs or validation endpoints shortly after an auto-login response.
• Payloads containing OS, file, or network functions in decorators, default arguments, or annotations.
• Abnormal communication from Langflow to metadata endpoints, LLM providers, or unknown hosts.
• New files, cron jobs, SSH keys, or MCP configurations inside the service or container.

Log Gaps

• Request and response bodies, along with token subjects.
• Langflow admin and flow audit logs.
• Container process, file, and network telemetry.
• LLM provider API usage audit logs.

Priority Actions

1. Immediately upgrade to version 1.10.1 or later.
2. Stop external exposure.
3. Run services as non-root and minimize credentials.
4. Integrate API, token, and process telemetry.
5. Retro-hunt for past compromises even after patching.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-9198 affects Langflow versions 1.0.0 to 1.10.0.
• The auto-login endpoint issued a SUPERUSER token to network callers.
• The validate/code endpoint executed exec() on user code, allowing RCE via definition-time evaluation.
• IBM recommends upgrading to 1.10.1 and states there is no workaround.
• CISA confirmed active exploitation and added the flaw to the KEV catalog by August 5, 2026.
• CISA has not disclosed details on campaigns, malware, or ransomware usage.

Inference

• LLM provider keys and connector credentials held by Langflow should be treated as compromised when RCE succeeds.
• Applying patches alone does not remove existing backdoors or stolen API keys.

Hypothesis

• Public PoCs may lead to an increase in internet-wide scans and commodity payload deployment.
• Correlating the two endpoints (auto-login and validate/code) provides a more stable detection signal than single IOCs.

13. MITRE ATT&CK Mapping

High Confidence

• T1190 Exploit Public-Facing Application
• T1078 Valid Accounts (Can also be evaluated as medium confidence since it uses an issued superuser token rather than stolen credentials)
• T1059.006 Python
• T1059.004 Unix Shell (If a shell is launched on Linux/containers)
• T1528 Steal Application Access Token (If subsequent token theft is confirmed)

Medium / Low Confidence

• T1552.001 Credentials In Files: Secret access after RCE (Inference)
• T1552.005 Cloud Instance Metadata API: If metadata is reached (Hypothesis)
• T1105 Ingress Tool Transfer: When downloading additional payloads
• T1505 Server Software Component: If flows/components are abused for persistence
• T1021 Remote Services: During internal lateral movement

14. Unknowns and Additional Investigations

• Source IPs, IOCs, and payloads for the attacks confirmed by CISA.
• When the exploitation started and how many instances were targeted.
• Execution privileges of the Langflow process.
• Stolen LLM, cloud, or vector store credentials.
• Presence of persistent flows, components, or files.
• Subsequent payloads like ransomware or cryptominers.
• Public and affected instances globally.

15. Impact on SOCs and General Organizations

Instances where Langflow was exposed briefly for PoCs, testing, or internal AI agent platforms are also at risk. Because AI platforms aggregate multiple LLMs, databases, vector stores, and cloud credentials, a single RCE has a wide blast radius. Organizations need to check asset inventories to include non-production AI development environments, and perform patching, exposure checks, secret rotation, and retro-hunting all at once.

16. Summary for SOCs, Administrators, and Users

For SOCs

• Correlate auto-login → validate/code → Python/shell activities.
• Hunt retrospectively for past token issuance, flow/file tampering, and provider API usage even after patching.
• Differentiate between confirmed active exploitation and confirmed follow-up compromises.

For Administrators

• Immediately upgrade to version 1.10.1 or later and stop external exposure.
• Rotate all credentials and API keys held by Langflow.
• Apply non-root configurations, network segmentation, and restricted egress.

For Users

This is a server-side attack that requires no user action. Promptly follow instructions from administrators if they ask you to stop or reset AI workflows and API keys.