Public PoC Lands for Langflow's 9.8 Unauth RCE — Patch to 1.10.1 Now

The mechanics first. CVE-2026-9198 is a code-injection flaw (CWE-94) in Langflow, the open-source framework for wiring up LLM and agent workflows. On a default deployment it chains two API endpoints that should never have lined up the way they do: one issues a SUPERUSER token to any network caller without authentication, and the other accepts supplied code and runs it through a Python exec(). The result is unauthenticated remote code execution, rated CVSS 9.8, against Langflow’s own process — no credentials, no user interaction.

That is the entire distance from “can reach the port” to “runs code as the service.” We’re describing the shape of the bug, not the payload — but the shape is enough to tell you why CISA moved on it.

What’s affected, what fixes it

The flaw affects IBM Langflow OSS 1.0.0 through 1.10.0. It is fixed in 1.10.1, which IBM shipped on July 17, 2026, the same day it disclosed the issue, per The Hacker News. There is no configuration that closes this on a vulnerable build; the auth-bypass-to-exec path is in the code, so the version number is the whole story.

Why this is on your afternoon, not your backlog

Three facts stack:

• It’s on CISA’s KEV. CVE-2026-9198 was added to the Known Exploited Vulnerabilities catalog on August 4 on evidence of active exploitation, alongside the Apache Tomcat and N-central flaws from the same batch.
• A public proof-of-concept is now out. That is the change since the KEV listing: the barrier to entry just dropped from “actor with the exploit” to “anyone who can copy a script.” When a PoC for an unauthenticated 9.8 goes public, the exploitation curve steepens fast.
• Langflow is exactly the kind of box that ends up exposed. It’s AI-infra tooling that teams stand up quickly, often on an internet-reachable host during a proof-of-value, and forget to lock down. That is the population this bug hunts.

This is not Langflow’s first KEV appearance — CVE-2026-0770 put it on the catalog earlier this year. A tool that keeps landing on KEV is telling you something about where it sits in your network.

What to do

Upgrade to Langflow 1.10.1 or later. Then answer one question about every Langflow instance you run: was it network-reachable while on a build below 1.10.1? If yes, it was exploitable before the PoC made it trivial — treat it as potentially compromised, review process and child-process activity around the Langflow service, and rotate any credentials or tokens that instance could reach. And whether or not you’ve patched, Langflow does not belong on an interface exposed to untrusted networks — the one detail worth writing down is that this service should be behind authentication you control, not its own.

Sources: CISA KEV alert (Aug 4, 2026); The Hacker News. CVSS, affected versions, and fix details are as published by the vendor and CISA — verify against IBM’s advisory before acting.