Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-9198

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM Langflow OSS

Default version status: unaffected

  • 1.0.0 to ≤ 1.10.0affected

References