Langflow CVE-2026-9198: Active Exploitation RCE via Auto-Login Superuser Token and Code Validator `exec()` Chain

Langflow CVE-2026-9198: Active Exploitation RCE via Auto-Login Superuser Token and Code Validator exec() Chain 1. Basic Information Article Title : CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws Publisher : BleepingComputer Publication Date : August 5, 2026 Source : BleepingComputer Primary / Related Sources : CISA KEV Catalog , IBM Security Bulletin Related CVE : CVE-2026-9198 Affected Products : Langflow OSS 1.0.0 to 1.10.0, AI agent workflow, Python Related Malware / Threat Groups : CISA confirmed active exploitation, but specific campaigns, malware, and threat groups are not disclosed Severity : Critical IBM published technical details on July 2, 2026. The new development is that CISA confirmed active exploitation and added the flaw to the KEV catalog on August 5, 2026. N-central and Apache Tomcat are covered in other reports or previous Unit 42 cases, so this report focuses only on Langflow. 2. One-Sentence Summary This is a two-stage RCE. An attacker gets a SUPERUSER bearer token without authentication from the enabled-by-default /api/v1/auto_login endpoint, and then sends Python decorators, default arguments, and annotations to /api/v1/validate/code using that token to trigger exec() during definition time, executing OS commands with Langflow process privileges. 3. Attack Flow Chain A: Authentication Bypass to Python RCE The attacker finds a network-accessible Langflow instance. The attacker sends an unauthenticated request to GET /api/v1/auto_login . The endpoint issues a SUPERUSER bearer token to any network caller. The attacker sends a malicious Python function definition with the token to POST /api/v1/validate/code . The validator runs exec() instead of only doing safe parsing and compilation. Decorators, default arguments, and annotations evaluate during function definition. Arbitrary commands execute with Langflow backend process privileges. Chain B: Expected Scope After Compromise LLM provider API keys and database credential