{"id":"ibm-langflow-code-injection-jul-2026","category":"patch","status":"live","title":"IBM Langflow code execution flaw CVE-2026-9198 used in attacks; fixed in 1.10.1","tldr":"Attackers are exploiting IBM Langflow OSS 1.0.0–1.10.0 to run code without signing in. Version 1.10.1 fixes this flaw. Ask whoever runs your AI systems to update, investigate exposed servers and replace exposed credentials.","summary":"CVE-2026-9198 affects IBM Langflow OSS, a visual tool for building AI applications and workflows. On default deployments with automatic login enabled and the code-validation service reachable over the network, an attacker can run code on the server without an account or user interaction. IBM's bulletin was first published on 2 July and identifies versions 1.0.0 through 1.10.0 as affected. Version 1.10.1 fixes this vulnerability; IBM lists no workaround. CISA recorded it as exploited on 4 August. Bitbison subsequently observed attackers installing cryptocurrency miners and remote-control malware and retrieving planted credentials from deliberately exposed test servers. Previdian reports attempts continuing through 3 November, although its sensor totals do not establish successful compromises. The number of affected organisations is not known. Organisations running vulnerable installations should update and investigate possible compromise, including exposure of credentials available to Langflow.","action":"If your business or family office runs Langflow, ask its IT provider to update to the latest release; version 1.10.1 fixes this particular flaw. Have any exposed vulnerable server checked for compromise and replace credentials available to it. Families who do not run Langflow have no direct update to install.","product":"IBM Langflow OSS","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-9198"],"tags":["ibm","langflow","ai","remote-code-execution","actively-exploited"],"affected":["IBM Langflow OSS 1.0.0–1.10.0"],"fixed":["IBM Langflow OSS 1.10.1"],"matches":[],"sources":[{"kind":"advisory","title":"Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation","url":"https://www.ibm.com/support/pages/security-bulletin-unauthenticated-remote-code-execution-auto-login-bypass-and-code-validation","by":"IBM","date":"2026-07-02"},{"kind":"advisory","title":"CVE-2026-9198 — IBM and CISA records reproduced by OpenCVE","url":"https://app.opencve.io/cve/CVE-2026-9198","by":"OpenCVE","date":"2026-07-17"},{"kind":"news","title":"IBM's agentic AI platform is under active attack - patch now","url":"https://assets.theregister.com/2026/08/05/202615/","by":"The Register","date":"2026-08-05"},{"kind":"news","title":"CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited","url":"https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html","by":"The Hacker News","date":"2026-08-05"},{"kind":"research","title":"Langflow RCE: 34 minutes to server compromise","url":"https://bitbison.io/blog/langflow-rce-exposure/","by":"Bitbison","date":"2026-08-19"},{"kind":"research","title":"CVE-2026-9198 Exploitation Attempts Observed — Langflow OSS","url":"https://previdian.com/CVE-2026-9198","by":"Previdian","date":"2026-11-03"}],"started":"2026-08-04","closed":null,"created":"2026-11-03T22:15:52.637Z","updated":"2026-11-03T22:15:52.637Z","cve_notes":[{"cve":"CVE-2026-9198","name":"Langflow auto-login and code-validation code execution","what":"Linked weaknesses in Langflow's automatic login and code validation let an attacker run code on a network-accessible default deployment without signing in.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-11-03","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Previdian continued to report exploitation attempts through 3 November. Its live page showed 3,487 attempts from 1,311 source IP addresses; these are sensor observations, not counts of compromised organisations.","url":"https://previdian.com/CVE-2026-9198","by":"Previdian","patch":null},{"at":"2026-08-19","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Bitbison reported successful code execution in 12 of 18 exposure windows on deliberately vulnerable test servers. Attackers installed cryptocurrency miners and remote-control malware and retrieved planted credentials.","url":"https://bitbison.io/blog/langflow-rce-exposure/","by":"Bitbison","patch":null},{"at":"2026-08-04","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalogue. CISA's data reproduced by OpenCVE gives US federal civilian agencies a remediation deadline of 7 August.","url":"https://app.opencve.io/cve/CVE-2026-9198","by":"OpenCVE","patch":null},{"at":"2026-07-17","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"IBM's CVE record was published, assigning CVE-2026-9198 a critical severity score of 9.8.","url":"https://app.opencve.io/cve/CVE-2026-9198","by":"OpenCVE","patch":null},{"at":"2026-07-06","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Previdian says its sensors first observed exploitation attempts on this date. Its observations do not establish whether those attempts succeeded.","url":"https://previdian.com/CVE-2026-9198","by":"Previdian","patch":null},{"at":"2026-07-02","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"IBM dates its initial bulletin to 2 July. It identifies Langflow OSS 1.0.0–1.10.0 as affected, recommends version 1.10.1 and lists no workaround.","url":"https://www.ibm.com/support/pages/security-bulletin-unauthenticated-remote-code-execution-auto-login-bypass-and-code-validation","by":"IBM","patch":"patched"}],"url":"https://hard.fyi/live/ibm-langflow-code-injection-jul-2026/","json":"https://hard.fyi/api/live?id=ibm-langflow-code-injection-jul-2026"}