Critical RCE in IBM Langflow Triggers CISA Emergency Deadline

Federal agencies have until August 7, 2026, to remediate or disconnect assets affected by a critical vulnerability in IBM Langflow, tracked as CVE-2026-9198. This mandate follows the inclusion of the vulnerability in the CISA Known Exploited Vulnerabilities (KEV) catalog on August 4, 2026, under Binding Operational Directive (BOD) 26-04. The vulnerability, which carries a CVSS score of 9.8, allows unauthenticated attackers to achieve full remote code execution (RCE) by chaining two default API endpoints.

The attack mechanism is straightforward: an attacker can call the /api/v1/auto_login endpoint, which, in default configurations where LANGFLOW_AUTO_LOGIN=true, mints a SUPERUSER token for any network caller. With this token, the attacker can then access the /api/v1/validate/code endpoint to execute arbitrary Python code via exec(). Because no authentication is required, the exploit functions on default deployments out of the box.

Under BOD 26-04, federal agencies are required to remediate the vulnerability or disconnect affected assets by the August 7 deadline. Furthermore, the directive requires agencies to perform forensic triage to determine if threat actors compromised their systems prior to the application of patches. Proof-of-concept code for this vulnerability was published in July 2026, and active exploitation has been observed in the wild.

Langflow, a Python-based visual interface for constructing and executing AI-powered agent workflows, is now a core component of IBM’s watsonx portfolio following the acquisition of its parent company, DataStax. Because Langflow serves as the orchestration layer for agent pipelines, a successful RCE compromise grants an attacker total control over the system, including the ability to manipulate the agent workflows themselves.

This incident is not an isolated event for the platform. It follows a documented pattern of security failures, including CVE-2026-33017, an unauthenticated RCE with a CVSS score of 9.3 that was exploited within 20 hours of disclosure, and CVE-2026-55255, an IDOR vulnerability used to harvest LLM provider keys, cloud credentials, and database secrets. These recurring vulnerabilities demonstrate a systemic failure to secure the authentication boundaries of the agent-infrastructure stack.

The timing of this disclosure coincides with Black Hat USA 2026, where agent infrastructure security has emerged as the dominant theme. The industry focus on this topic is reflected in recent discussions, including Black Hat Day 1 Briefings, the MCP Vendor Wave, and analysis of how DeepSeek has been utilized as an attack engine. Over the past 48 hours, more than 15 vendors have launched specialized products aimed at securing this specific layer of the AI stack.

Organizations currently running Langflow in production must act immediately. Remediation requires upgrading to Langflow 1.10.2, explicitly setting LANGFLOW_AUTO_LOGIN=false, and restricting network exposure of the Langflow API. With the CISA deadline arriving tomorrow, teams have less than 24 hours to secure their environments against active exploitation.