RECONINTEL
◄ ALL RESEARCH
JULY 21, 2026 · UPDATED AUGUST 10, 2026CVSS 9.8 · CISA KEV · ACTIVELY EXPLOITED8 MIN READ

Langflow RCE Chain (CVE-2026-9198): auto_login Auth Bypass Turns validate/code Into Unauthenticated Code Execution

In July 2026, IBM published a wave of Langflow OSS vulnerabilities that includes several authenticated remote code execution flaws — and, more importantly, the unauthenticated flaws that make them reachable. IBM assigned CVE-2026-9198 (CVSS 9.8) to a specific chain: an unauthenticated caller hits /api/v1/auto_login to mint a superuser token, then hits /api/v1/validate/code to run arbitrary Python via exec() — full RCE on a default Langflow deployment. Two other unauthenticated flaws in the same wave, CVE-2026-9103 (the auth bypass itself) and CVE-2026-8505 (a webhook bypass), widen the front door further. It is the same shape as CVE-2026-33017 — the Langflow flaw CISA added to its Known Exploited Vulnerabilities catalog after attackers used it to drop cryptominers on internet-exposed AI servers.

Update, August 10, 2026 — this is no longer theoretical. When this post was published on July 21, no public evidence of in-the-wild exploitation of the July 2026 Langflow CVEs had been found. That has changed: CISA added the keystone chain CVE-2026-9198 to the Known Exploited Vulnerabilities catalog on August 4, 2026 — the catalog's bar is reliable evidence that a flaw has been exploited — with a remediation deadline of August 7 for federal civilian agencies under BOD 26-04. Separately, CVE-2026-0770 — another unauthenticated RCE reaching the same validate endpoint — was added to KEV on July 21. Langflow now has six KEV-listed CVEs. Two further critical flaws were published to NVD on July 30, CVE-2026-12940 and CVE-2026-13435, both covered by the same 1.10.2 upgrade this post already recommends. The sections below have been corrected throughout.

The Pattern: Authentication as a Containment Boundary

Langflow is an open-source visual builder for AI agents and workflows. Its core function is to let users assemble and run Python-backed components — which means the server executes user-defined logic by design. The recurring security problem is not that Langflow runs code; it is that Langflow has repeatedly treated authentication, input validation, and feature flags as containment boundaries for code-execution surfaces that were never sandboxed. When one of those routing controls fails, the result is arbitrary code execution as the Langflow server process. The July 2026 wave is a clean illustration: several distinct execution sinks, and multiple default-on flaws that let an unauthenticated attacker reach them.

The Keystone: CVE-2026-9198 (Officially Assigned Unauthenticated Chain)

  • CVSS: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — no authentication required
  • CHAIN: /api/v1/auto_login mints a superuser token to any network caller → /api/v1/validate/code executes user code via exec() → full RCE on default deployments
  • AFFECTED: Langflow OSS 1.0.0 through 1.10.0
  • EXPLOITED: Yes — added to CISA KEV on August 4, 2026; federal civilian agencies had a three-day remediation deadline of August 7 under BOD 26-04. Known ransomware use: Unknown
  • STATUS: IBM CNA record, published July 17, 2026
  • ADVISORY: NVD: CVE-2026-9198

This matters because the chain is not an inference drawn from separate advisories — IBM assigned it its own CVE. The two halves also exist as standalone records: CVE-2026-9103 (CVSS 9.8) documents the auto_login endpoint issuing long-lived superuser bearer tokens with no authentication when AUTO_LOGIN is enabled — the default — with permissive CORS potentially exposing those tokens to unintended origins (one wrinkle for anyone cross-referencing records: the CVE-2026-9103 entry cites the path as /api/v1/login/auto_login, while the CVE-2026-9198 chain record and Langflow's own advisory use /api/v1/auto_login); CVE-2026-8481 (CVSS 9.9) documents validate/code running user-supplied Python through exec() with no sandbox. CVE-2026-9198 is the composition of the two, established by the vendor.

A Second Front Door: CVE-2026-8505 (Webhook Auth Bypass)

CVE-2026-8505 (CVSS 9.8, unauthenticated) is an independent path to flow execution. Langflow's webhook authentication logic incorrectly bypasses API key validation when WEBHOOK_AUTH_ENABLE is set to False — which IBM's advisory calls the default. Langflow's source tells a more nuanced story: the setting shipped as False only through v1.9.0 and flipped to True from v1.9.1 onward, so across most of the affected range it was not the default. Either way, verify your own deployment rather than trusting the advisory's blanket claim. A remote attacker who knows a flow's UUID can trigger a disabled-auth webhook as if they were the owner, potentially leading to RCE. Like CVE-2026-33017 before it, exploitation hinges on obtaining a flow UUID; unlike the authenticated RCEs, it needs no login at all.

The Sinks: Authenticated RCEs the Bypass De-Gates

Beyond the officially chained validate/code path, the same wave includes four more code-execution flaws, each rated as requiring an authenticated, low-privilege user (PR:L). Two of them (CVE-2026-8476 and CVE-2026-9135) carry a Scope: Changed metric (S:C), meaning the impact crosses a security-authority boundary rather than staying confined to the vulnerable component:

  • CVE-2026-8476: 9.9 (S:C) — the AsyncDiskCache class deserializes cached objects with pickle.loads() without validation. Prerequisite: a usable path to influence data later read from the disk cache (workflow inputs, custom components, the API, or file-system access).
  • CVE-2026-9135: 9.9 (S:C) — the Policies component's ToolGuard integration bypasses allow_custom_components=false, because validation inspects only the main component source, not the dynamic CodeInput fields where ToolGuard code is stored. Prerequisite: flow-creation ability plus later invocation of the guarded tool. (Its record is internally inconsistent on the upper bound — the structured range says through 1.10.0, the description says up to 1.9.2 / commit 94981c4.)
  • CVE-2026-14499: 8.8 — command injection in the Python Interpreter component via improper input validation. Prerequisite: the Python Interpreter component reachable through a flow.
  • CVE-2026-7755: 8.8 — RCE via incomplete validation enforcement on MCP server configuration files. Prerequisite: access to the MCP server configuration path.

How strong is the chaining claim? For the validate/code path, IBM has done the work: CVE-2026-9198 is the assigned, vendor-confirmed unauthenticated chain. The four flaws above are separate two-stage possibilities of the form auth bypass → one authenticated primitive. The auth bypass removes their authentication prerequisite, but each still carries additional prerequisites (cache influence, flow creation, component reachability) and none was reproduced end-to-end for this analysis. Treat them as advisory-derived alternative paths, not confirmed exploits — the architectural point is that on a default deployment, "authenticated-only" is doing far less work than it appears to.

Disclosed Since Publication: Two More Critical Sinks

Two further Langflow OSS CVEs, both IBM CNA records, were published to NVD on July 30, 2026, after this post first ran. Both affect the same 1.0.0–1.10.1 range and both are fixed by the 1.10.2 upgrade already recommended below — but they are worth reading, because each one repeats a containment failure the post describes rather than introducing a new class of problem:

  • CVE-2026-12940: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — unauthenticated RCE via environment-variable injection in the MCP (Model Context Protocol) stdio launcher. In src/lfx/src/lfx/base/mcp/util.py, the DANGEROUS_ENV_VARS blocklist omits SHELLOPTS, BASHOPTS, and PS4. The dangerous combination is the first and third: SHELLOPTS=xtrace turns on execution tracing, and bash expands PS4 to print each traced line — running any command substitution the attacker put inside it. (BASHOPTS carries shopt-style options rather than xtrace; it belongs in the blocklist for the same reason, but it is not the mechanism here.) This is the same shape as CVE-2026-7755: the MCP configuration path treated as a validated boundary when it is really an execution one.
  • CVE-2026-13435: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) — improper input validation in the PythonREPL sandbox implementation. Authenticated (PR:L) with Scope: Changed, so it belongs with the sinks above rather than the front doors — and like them, it inherits the same open question of whether the auth bypass alone is enough to reach it. IBM's advisory does not detail the escape technique, so treat that as unresolved rather than assumed.

Why a blocklist keeps losing. CVE-2026-12940 is the clearest miniature of the whole pattern. Denying a list of dangerous environment variables only works if the list is complete, and the set of bash variables that can induce command execution is neither short nor stable. It is the same bet as gating an exec() endpoint behind an auth check: correct until one entry is missing.

Why This Keeps Happening: The validate/code Timeline

CVE-2026-8481 is not the first time /api/v1/validate/code has been a remote code execution sink. The endpoint's history is the clearest evidence of the pattern — for more than a year Langflow patched the path to Python execution rather than the execution capability itself, until the 1.10.1 fix finally removed execution from the validation endpoint:

  • • CVE-2025-3248 (April 2025, CVSS 9.8) — /api/v1/validate/code was reachable without authentication in versions prior to 1.3.0. A remote unauthenticated attacker could send crafted requests to execute arbitrary code. The fix added an authentication requirement. This one is also CISA KEV-listed (added May 2025).
  • • CVE-2026-0770 (January 2026, CVSS 9.8) — the validate endpoint again, this time through its exec_globals parameter, which pulled functionality in from an untrusted control sphere. Reported through the Zero Day Initiative (ZDI-26-036), no authentication required, and ZDI notes the resulting code runs in the context of root. This one is now CISA KEV-listed as well (added July 21, 2026).
  • • CVE-2026-33017 (March 2026, CVSS 9.8) — a different unauthenticated endpoint, /api/v1/build_public_tmp/{flow_id}/flow, reached an unsandboxed execution sink via attacker-supplied flow data in versions prior to 1.9.0. This one was actively exploited and added to CISA KEV; threat research tied it to cryptominer deployment on exposed Langflow servers. Exploitation required knowing or creating a public-flow UUID — which default auto-login helps supply.
  • • CVE-2026-8481 (July 2026, CVSS 9.9) — /api/v1/validate/code is a code execution sink again. The 2025 fix added authentication, but the endpoint still runs user input through exec(). It is now rated PR:L — authenticated — which is exactly the gate that CVE-2026-9103 removes, and CVE-2026-9198 is the assigned chain that does so.

The trajectory is telling: the same validation endpoint went from unauthenticated code execution, to unauthenticated code execution again through a different parameter, to authenticated code execution, to authenticated code execution behind an authentication bypass. For years each remediation moved the boundary — adding auth, closing a public path, filtering one parameter — rather than containing execution, until the 1.10.1 fixes finally addressed the validation endpoint itself. Three of the four flaws listed above — CVE-2025-3248, CVE-2026-0770, and CVE-2026-33017 — are CISA KEV-listed, and so is CVE-2026-9198, the chain that re-opens the fourth.

One caveat for precision: the July wave also includes CVE-2026-7873 (CVSS 9.9, published June 30), another authenticated arbitrary-command-execution flaw across the same 1.0.0–1.10.0 range. Whether CVE-2026-7873 and CVE-2026-8481 are distinct issues or overlapping assignments for related behavior is not fully clear from the public records — so read the "recurrence" here as a pattern across closely related CVEs, not necessarily five cleanly independent bugs.

Not Unique to Langflow: Unsafe Deserialization Recurs

The pickle-based flaw in CVE-2026-8476 belongs to a bug class that shows up repeatedly in fast-moving AI infrastructure. The LLM inference framework ktransformers illustrates how persistent it can be: the same unsafe-deserialization pattern drew two overlapping CVE assignments months apart — CVE-2026-26210 (through 0.5.3, April 2026) and CVE-2026-63767 (through 0.6.3, July 2026). An April pull request for the earlier CVE was closed without merging, and the first merged mitigation landed in commit def0f93. Both describe a ZMQ ROUTER socket bound to all interfaces, no authentication, deserializing incoming messages via pickle.loads(); both scored CVSS 9.8 and both unauthenticated. Rather than a bug reintroduced, this reads as one long-unfixed issue — the same primitive as CVE-2026-8476, exposed on the network instead of through a cache file. The lesson is not that one framework is uniquely careless, but that pickle.loads() on untrusted input remains a live pattern worth hunting for.

AI Infrastructure Coverage

Two disclosures, one recurring failure: AI platforms execute tenant-supplied logic by design, then treat authentication, feature flags, or RBAC roles as the containment boundary.

  • • Red Hat OpenShift AI — A 20-CVE disclosure — trusted identity headers, RBAC aggregation, and operators that run tenant input, all turning a namespace tenant into cluster admin
  • • Langflow RCE chain — you are here
  • • New API quota overflow — An unbounded image count overflows 64-bit quota math to a negative charge — one request mints trillions in free AI credits, exploited in the wild

Investigation Workflow: Find Exposed Langflow Instances

Langflow is self-hosted software, not an appliance. Instances are stood up by developers and data teams, often on cloud VMs or inside internal networks, and — because CVE-2026-33017 was mass-exploited — internet-exposed deployments are a known risk. The first defensive step is inventory: find every Langflow instance you run before an attacker does. Discovery falls into two categories, and the distinction matters legally and operationally.

Passive discovery — Shodan, certificate-transparency logs, and passive DNS — surfaces candidates without touching the target. Active checks — connecting to a port, requesting a page — are direct interactions and should be run only against systems you are authorized to assess. Never request a token from /api/v1/auto_login or post to /api/v1/validate/code on a system you do not own: those mint privileged credentials and execute code, which is intrusion, not reconnaissance.

1. Port Scan: Find Langflow Servers

Langflow serves its web UI and API on a single HTTP port. The documented default host is localhost, but the common ways Langflow gets deployed — Docker port publishing, an explicit --host 0.0.0.0, or a reverse proxy — routinely make it network-reachable, which is how accidental exposure happens:

  • • 7860 — default Langflow HTTP port (web UI and /api/v1; configurable via LANGFLOW_PORT)
  • • 80 / 443 — where Langflow sits behind a reverse proxy (nginx, Traefik, cloud load balancer)
  • • 3000 / 8000 / 8080 — common alternate ports operators choose when remapping

2. HTTP Headers & Endpoints: Fingerprint Langflow

On systems you control or are authorized to test, Langflow exposes distinctive endpoints. None is a perfect fingerprint — combine several and expect false positives:

  • • /docs — the OpenAPI / Swagger UI, which enumerates the API surface including /api/v1/validate/code and /api/v1/auto_login (may be disabled or hidden behind a proxy)
  • • /health — a status endpoint (common to many frameworks, so not unique on its own)
  • • HTML title and app shell referencing Langflow

What this establishes: version plus network exposure indicates potential vulnerability — not confirmed vulnerability, and not AUTO_LOGIN or WEBHOOK_AUTH_ENABLE state, which are server-side settings you can only confirm through your own configuration, not remote probing. Langflow does not advertise its version in HTTP headers, so version confirmation requires the authenticated UI or your deployment records.

3. TLS Inspect: Examine Certificates

Where Langflow is fronted by TLS, pull the certificate and look for internal hostnames — langflow.*, flows.*, ai.*, or generic self-signed / Let's Encrypt certs on non-standard ports. Certificate-transparency logs are a passive source for the same signal and often reveal shadow deployments that inventory tools miss.

4. DNS: Discover Langflow Infrastructure

Query DNS for naming patterns operators use for AI tooling: langflow.*, flow.*, flows.*, agents.*, ai.*. Self-hosted developer tools are frequently given descriptive subdomains that give away their function.

5. CVE Lookup: Track the Wave and Its KEV Status

Track the unauthenticated flaws first — CVE-2026-9198 (KEV, August 4), CVE-2026-9103, CVE-2026-8505, and CVE-2026-12940 — then the authenticated sinks CVE-2026-8481, CVE-2026-8476, CVE-2026-9135, CVE-2026-14499, CVE-2026-7755, and CVE-2026-13435, alongside the historical CVE-2026-33017, CVE-2026-0770, and CVE-2025-3248. Six of these are on the CISA KEV catalog, and the interval between additions has compressed sharply: 324 days from the first to the second, then 57, then 47, then 14 and 14. Five of the six landed in 2026.

Cross-Reference with External Data

  • SHODAN: Search http.title:"Langflow" or http.html:"langflow" to find internet-exposed instances (passive)
  • CVE LOOKUP: Track CVE-2026-9198, 9103, 8505, 8481, 8476, 9135, 14499, 7755, 12940, and 13435, plus CVE-2026-33017, CVE-2026-0770, and CVE-2025-3248
  • CISA KEV: Six Langflow CVEs are KEV-listed (actively exploited): CVE-2025-3248 (May 2025), CVE-2025-34291 (May 2026), CVE-2026-33017 (March 2026), CVE-2026-55255 (July 7, 2026), CVE-2026-0770 (July 21, 2026), and — the keystone chain in this post — CVE-2026-9198, added August 4, 2026 with an August 7 federal remediation deadline under BOD 26-04. The remaining July 2026 CVEs are not individually KEV-listed, but five of these six additions happened in 2026, the last three at two-week intervals
  • NVD: The July Langflow CVEs are IBM CNA records, published July 17, 2026; CVE-2026-12940 and CVE-2026-13435 followed on July 30, 2026

Remediation

  1. Upgrade to Langflow 1.10.2 or later — treat this as overdue, not scheduled. The auth bypass (CVE-2026-9103), webhook bypass (CVE-2026-8505), and most of the RCE sinks are fixed in 1.10.1; CVE-2026-14499, CVE-2026-12940, and CVE-2026-13435 require 1.10.2. Upgrading to 1.10.2+ addresses every Langflow CVE discussed here. With CVE-2026-9198 now KEV-listed and the federal BOD 26-04 deadline of August 7, 2026 already past, an unpatched internet-reachable instance should be handled as a potential incident rather than a pending maintenance item — that deadline binds FCEB agencies, but the exploitation evidence behind it applies to everyone.
  2. Rotate secrets and revoke tokens after patching. The auto_login flaw mints long-lived superuser bearer tokens; upgrading does not necessarily invalidate tokens already issued. Revoke existing sessions and API keys, rotate the JWT signing secret, and rotate any application or cloud credentials the server could reach. On instances that were internet-exposed pre-patch, treat the host or container as potentially compromised.
  3. Disable AUTO_LOGIN and enforce real authentication. Even on a patched build, AUTO_LOGIN=true means no login is enforced. Set LANGFLOW_AUTO_LOGIN=false, configure a superuser, and require credentials.
  4. Enable webhook authentication. CVE-2026-8505 is exploitable when WEBHOOK_AUTH_ENABLE=False. This default varied across affected releases, so verify that your deployment explicitly sets it to True, which makes webhook flow execution enforce API-key validation.
  5. Get Langflow off the public internet. Whether via container port publishing, an explicit host binding, or a proxy, exposed instances are the risk. Place Langflow behind a VPN, an authenticating reverse proxy, or an IP allowlist. CVE-2026-33017 was mass-exploited specifically because instances were internet-reachable.
  6. Do not rely on feature flags as security boundaries. The Python Interpreter, custom components, and code-validation endpoints execute code by design. CVE-2026-9135 shows allow_custom_components=false was bypassable — restrict who can reach these surfaces at the network and identity layer, not just via a flag.
  7. Hunt for prior compromise. This is now the highest-value step, not the optional one: CVE-2026-9198 is KEV-listed, so the chain this post describes is confirmed to have been used against real deployments. Review exposed instances for unexpected processes (especially miners), requests to /api/v1/auto_login or /api/v1/validate/code, new superuser accounts, unfamiliar flows or custom components, child processes, file writes, and outbound connections to unknown hosts. Because auto_login issues long-lived tokens, scope the log review back to when the instance was first exposed, not to the KEV date.

Every tool used in this investigation — port scan, HTTP headers, TLS inspect, DNS, CVE lookup — runs from your phone in RECON. Get it on the App Store.

Follow @hellorecon for new CVE investigations.

Sources

By Vladimir Slavin · Founder, RECON · [email protected]
// INTEL FEED

Get the next investigation

New CVE teardowns — root cause from the source, a working proof-of-concept, and how to check your own estate — in your inbox when they publish. No spam, unsubscribe anytime.