CISA added a second Langflow flaw to its Known Exploited Vulnerabilities catalog within a month, giving federal agencies until August 7 to patch a critical, unauthenticated remote code execution bug already being exploited in the wild.
The vulnerability, CVE-2026-9198, carries a CVSS score of 9.8. Per the National Vulnerability Database, it lets an unauthenticated attacker chain the /api/v1/auto_login endpoint, which mints a superuser token to any network caller with no credentials, together with /api/v1/validate/code, which executes submitted code through Python’s exec(). The result is full remote code execution on any default Langflow deployment. Affected versions run from 1.0.0 through 1.10.0; the fix shipped in 1.10.1, released in July. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 4.
Langflow is a widely used open source, low code builder for AI agent workflows, frequently self-hosted by teams standing up internal automation with no additional authentication layer in front of it. For security leaders, an unauthenticated path straight to code execution on a tool that is often deployed quickly and outside normal application review is exactly the kind of exposure attackers scan for first, and CISA’s KEV addition confirms this one is already being used.
This is not Langflow’s first trip to the KEV list this year. As CyberTech reported in July, a separate flaw, CVE-2026-0770, became the platform’s fourth KEV listing of 2026. The recurrence is the more useful signal for defenders than any single CVE: a pattern of repeat unauthenticated code execution paths in the same product points to an architectural gap, not a series of unrelated bugs, and teams running Langflow or similar low code AI agent builders should treat whether an instance is reachable from the open internet without authentication as a standing question to re-verify, not a one time deployment checkbox.
Source: National Vulnerability Database
