The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding active exploitation of a critical vulnerability, CVE-2026-9198, in IBM's Langflow platform. The flaw, which has been added to CISA's Known Exploited Vulnerabilities catalog, allows unauthenticated remote code execution (RCE) on default deployments of the low-code AI builder. Organizations are strongly urged to apply vendor-recommended mitigations immediately.
IBM has confirmed the vulnerability affects Langflow open-source versions 1.0.0 through 1.10.0. The company advises users to upgrade to version 1.10.1 or later; the current version available is 1.11.2. The CVE was published on July 17, indicating a rapid transition from disclosure to active exploitation.
Langflow is an accessible, drag-and-drop graphical user interface designed for building AI agent and Retrieval Augmented Generation (RAG) workflows without extensive coding knowledge. It is available across Linux, Windows, and macOS operating systems.
The platform's ownership history involves several acquisitions. Originally developed by Logspace, Langflow was acquired by DataStax in 2024, and subsequently by IBM in 2025 as part of its acquisition of DataStax. Langflow has since been integrated into watsonx.ai, IBM’s AI development studio, as middleware to extend its capabilities.
According to IBM, the critical vulnerability stems from a chain of two issues present in default Langflow deployments. The first issue involves an auto-login endpoint that can mint superuser tokens to any network caller without authentication. The second issue is a code validation endpoint that will execute arbitrary Python code. Chaining these two vulnerabilities allows an unauthenticated attacker to gain superuser privileges and then execute arbitrary code, potentially leading to a complete compromise of the Langflow server.
The active exploitation highlights the risks associated with default configurations that leave critical endpoints accessible and insecure. While the extent of the exploitation is not yet known, the immediate addition to CISA's catalog underscores the severity and urgency of the threat.
