NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksUpdated

IBM Langflow code execution flaw CVE-2026-9198 used in attacks; fixed in 1.10.1

Attackers are exploiting IBM Langflow OSS 1.0.0–1.10.0 to run code without signing in. Version 1.10.1 fixes this flaw. Ask whoever runs your AI systems to update, investigate exposed servers and replace exposed credentials.

What to do

If your business or family office runs Langflow, ask its IT provider to update to the latest release; version 1.10.1 fixes this particular flaw. Have any exposed vulnerable server checked for compromise and replace credentials available to it. Families who do not run Langflow have no direct update to install.

What’s happening

CVE-2026-9198 affects IBM Langflow OSS, a visual tool for building AI applications and workflows. On default deployments with automatic login enabled and the code-validation service reachable over the network, an attacker can run code on the server without an account or user interaction. IBM's bulletin was first published on 2 July and identifies versions 1.0.0 through 1.10.0 as affected. Version 1.10.1 fixes this vulnerability; IBM lists no workaround. CISA recorded it as exploited on 4 August. Bitbison subsequently observed attackers installing cryptocurrency miners and remote-control malware and retrieving planted credentials from deliberately exposed test servers. Previdian reports attempts continuing through 3 November, although its sensor totals do not establish successful compromises. The number of affected organisations is not known. Organisations running vulnerable installations should update and investigate possible compromise, including exposure of credentials available to Langflow.

What
Flaw
Affects
IBM Langflow OSS
Affected
IBM Langflow OSS 1.0.0–1.10.0
Fixed in
IBM Langflow OSS 1.10.1
CVE
CVE-2026-9198
Since
4 Aug 2026

Timeline

  1. Wider attacks

    Previdian continued to report exploitation attempts through 3 November. Its live page showed 3,487 attempts from 1,311 source IP addresses; these are sensor observations, not counts of compromised organisations.

  2. Wider attacks

    Bitbison reported successful code execution in 12 of 18 exposure windows on deliberately vulnerable test servers. Attackers installed cryptocurrency miners and remote-control malware and retrieved planted credentials.

  3. CISA added

    CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalogue. CISA's data reproduced by OpenCVE gives US federal civilian agencies a remediation deadline of 7 August.

  4. Update

    IBM's CVE record was published, assigning CVE-2026-9198 a critical severity score of 9.8.

  5. Update

    Previdian says its sensors first observed exploitation attempts on this date. Its observations do not establish whether those attempts succeeded.

  6. Made publicFixed

    IBM dates its initial bulletin to 2 July. It identifies Langflow OSS 1.0.0–1.10.0 as affected, recommends version 1.10.1 and lists no workaround.

Sources

  1. Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationIBM · 2 July 2026
  2. CVE-2026-9198 — IBM and CISA records reproduced by OpenCVEOpenCVE · 17 July 2026
  3. IBM's agentic AI platform is under active attack - patch nowThe Register · 5 Aug 2026
  4. CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively ExploitedThe Hacker News · 5 Aug 2026
  5. Langflow RCE: 34 minutes to server compromiseBitbison · 19 Aug 2026
  6. CVE-2026-9198 Exploitation Attempts Observed — Langflow OSSPrevidian · 3 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS