IBM's agentic AI platform is under active attack - patch now

A critical vulnerability in IBM's low-code AI builder, Langflow, has been identified, putting organizations that use the platform at immediate risk. The vulnerability, CVE-2026-9198, allows unauthenticated attackers to execute code remotely on default deployments. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and urged organizations to apply the vendor's mitigation guidance as soon as possible.

IBM recommends upgrading to version 1.10.1 or later, with the most recent version being 1.11.2 at the time of writing.

Langflow, which is available on Linux, Windows, and macOS, is a drag-and-drop GUI that allows users to construct agent workflows without needing to know much about the underlying code. The platform was originally developed by Logspace, acquired by DataStax in 2024 before IBM purchased DataStax, including Langflow, in 2025. IBM integrated Langflow into watsonx.ai, their AI development studio, as middleware to enhance its capabilities.

The vulnerability affects default Langflow deployments and combines two issues that, when chained, enable an unauthenticated attacker to execute code remotely. First, there's an auto-login endpoint in default deployments that issues superuser tokens to any network caller. Combined with the second issue, a code validation endpoint that will run any Python code thrown at it, this creates a situation where an attacker could take over an entire Langflow server or worse.

The vulnerability was published on July 17, and it's already clear that bad actors are aware of the risks associated with exploiting this RCE flaw.

Langflow is not a user-friendly coding platform, but rather a tool for building agentic and Retrieval-Augmented Generation (RAG) workflows. However, the issue at hand is a clear example of how default configuration deployments can lead to disaster if not properly secured. It remains unclear how extensively this vulnerability has been exploited, and IBM has been contacted for more information.