The US Cybersecurity Agency CISA warns of active exploitation of a critical vulnerability in Langflow, a popular open-source platform for building AI agents among developers. The vulnerability rated CVSS 9.8, CVE-2026-9198, allows attackers to gain full remote access to standard installations without login credentials. CISA has set a deadline for US federal agencies to apply the update released in July by August 7, 2026.
Two chained endpoints provide full system access
Langflow is a visual low-code platform that allows users to assemble AI agents and retrieval workflows via drag-and-drop, without deep programming knowledge. IBM acquired the tool in 2025 with the acquisition of DataStax and integrated it into its development studio watsonx.ai. The vulnerability CVE-2026-9198 chains two weaknesses in the standard configuration of the software.
The endpoint /api/v1/auto_login grants a superuser token to any network caller without requiring login. This token can then be used to access the endpoint /api/v1/validate/code, which executes submitted Python code directly via the exec() function instead of just validating it securely. In combination, attackers can gain full control over the Langflow service without knowing a single password.
According to IBM, versions 1.0.0 to 1.10.0 are affected. The update to version 1.10.1, released on July 17, completely closes the vulnerability. Additionally, by the end of July, working exploit code was circulating freely online, complete with instructions for exploitation.
CISA sets a tight deadline for federal agencies to patch
The US Cybersecurity Agency officially added the vulnerability to its Known Exploited Vulnerabilities Catalog on August 4, 2026, confirming active exploitation in the wild. Civil US federal agencies must close the vulnerability by August 7, 2026. In the same bundle, CISA also marked a vulnerability in Apache Tomcat and two weaknesses in the remote maintenance software N-central as actively attacked.
This is already the second critical remote access vulnerability that CISA has confirmed in Langflow within two weeks. Vulnerable no-code tools for AI agents are accumulating this summer. Just in June, a security researcher uncovered a comparably open network interface in the open-source platform Ruflo that allowed foreign server shells to be opened without credentials.
Those operating Langflow should immediately update to version 1.10.1 or newer and additionally isolate the auto-login endpoint from the open network via a firewall, advises IBM. While there is no legal obligation for private companies and organizations outside the US federal administration to update, security researchers also recommend immediate patching in light of the publicly circulating exploit code.
It will be crucial whether companies can keep up with the rapid growth of no-code platforms for AI agents when it comes to patching—especially since such tools often emerge outside of official IT oversight in individual departments. Whether CISA will release further details on the extent of the attacks after August 7 remains open.
