CISA added Langflow to its Known Exploited Vulnerabilities catalog again this morning — August 5 — for CVE-2026-9198, a critical unauthenticated remote code execution flaw. If your team runs Langflow for AI workflow automation on any version from 1.0.0 to 1.10.0, this is the thing you do today.
This is the third Langflow vulnerability confirmed as actively exploited this year. The pattern is worth paying attention to.
What Langflow is and who's running it
If you haven't come across it yet: Langflow is a visual, drag-and-drop AI workflow builder. You connect LLMs, data sources, APIs, and custom logic without writing much code. It runs self-hosted, which was the pitch — own your workflows, keep your data in-house, avoid vendor lock-in.
That pitch is real. A lot of NGOs and small-to-medium teams deployed it over the last year and a half for exactly those reasons. But self-hosted means you're also the one responsible for patching it.
What this vulnerability does
CVE-2026-9198 is a two-step attack that requires zero credentials.
Step one: hit Langflow's /api/v1/auto_login endpoint. In default deployments, this endpoint hands back a SUPERUSER bearer token to anyone who asks — no username, no password, no session cookie. You just ask, and it gives you the keys.
Step two: use that SUPERUSER token to call /api/v1/validate/code and submit any Python you want. Langflow executes it via Python's exec(). That's full host compromise in two HTTP requests.
The CVSS score is 9.8 out of 10. The attack requires no authentication, no user interaction, and no special conditions. An attacker who can reach your Langflow instance from the network owns it.
What's actually at stake
This is where a lot of teams underestimate the blast radius.
Langflow doesn't sit alone. It's designed to connect to things. A typical deployment at a 15-person org might hold:
- API keys for whatever LLM you're using — OpenAI, Mistral, whatever's in your workflow
- OAuth tokens for Google Workspace or Microsoft 365
- Database credentials for your CRM or internal systems
- Credentials to cloud storage buckets, internal APIs, or webhook endpoints
- AWS or Azure credentials if you're running in cloud infrastructure
So "an attacker compromised our Langflow server" isn't the end of the story. It's the beginning. The real question is what they can reach from there. For most teams that deployed Langflow specifically because it could connect to their whole operations stack, the answer is: a lot.
The API key angle is worth spelling out. LLM API keys get weaponized immediately. Attackers scrape them and sell them or run their own inference on your budget within hours of an exploitation. You'll know something happened because your API bill goes vertical. Everything else — credentials to your other systems — may stay quiet for much longer while the attacker maps what they can access.
The pattern in 2026
This is Langflow's third round in CISA's active exploitation list this year. The previous two:
March 2026 — CVE-2026-33017. Unauthenticated RCE via the public flow build endpoint. Active exploitation was observed within 20 hours of the advisory going public. That wasn't a typo — 20 hours from disclosure to active attacks in the wild.
June 2026 — CVE-2026-5027. Path traversal in the file upload endpoint. Combined with the default auto-login behavior (which ships enabled out of the box for ease of setup), an unauthenticated attacker could write files to arbitrary locations on the filesystem. Censys scans found roughly 7,000 publicly exposed Langflow instances at the time.
August 5, 2026 — CVE-2026-9198. What we're covering now.
The maintainers aren't asleep — they've shipped patches for all three, and CVE-2026-9198 was fixed in version 1.10.1. But the exploitation timeline keeps compressing. If your team treats AI workflow tools like a WordPress install from 2019 — deploy it, forget about it, let it run — you're in the attack window by the time CISA makes the announcement.
What to do
Check your version now. If you're running Langflow in a Python environment: pip show langflow. If you're running it in Docker, check your container image tag. Anything from 1.0.0 to 1.10.0 is affected.
Upgrade to 1.10.1 or later. The fix exists. Pull the updated Docker image or run pip install --upgrade langflow. If a third party manages your Langflow instance, contact them today — the CISA designation means federal agencies have a 21-day mandatory patch window. Your vendor should be treating it the same way.
Pull it off the public internet. If your Langflow is reachable from outside your network — Censys scans consistently find thousands of exposed instances — that's the higher-priority fix, even ahead of patching. No external access means the exploit can't reach the vulnerable endpoints. A VPN or IP allowlist buys you time to patch properly.
Rotate everything it touched. Assume any credentials stored in or accessible from your Langflow deployment are compromised until you've verified otherwise. Start with LLM API keys — revoke and reissue immediately. Then go through OAuth tokens, database credentials, and any cloud IAM credentials. Log into each provider, check for unexpected API activity, and issue fresh credentials.
Check your logs. Look for unexpected calls to /api/v1/auto_login and /api/v1/validate/code, particularly from IP addresses you don't recognize. If you find them, you have an active incident on your hands, not just a patching job. At that point the question is containment and forensics, not just upgrade-and-continue.
We've helped a number of clients deploy Langflow and it does real work. The visual workflow builder is genuinely useful for teams without deep engineering resources. But three critical RCEs in eight months is a signal that this platform, like most open-source AI tools right now, requires active maintenance — not set-it-and-forget-it.
If you've deployed AI workflow automation and haven't done a security review of what's running and what it has access to, that's a reasonable thing to do this week. We cover it as part of our implementation sprints: what's exposed, what credentials it holds, and whether the configuration matches the risk you're willing to carry. If you want a second set of eyes, reach out.