Langflow CVE-2026-9198: Active Exploitation RCE via Auto-Login Superuser Token and Code Validator `exec()` Chain

CVE-2026-9198 has been identified as a critical vulnerability affecting Langflow versions 1.0.0 through 1.10.0. This flaw allows for remote code execution (RCE) via a two-stage process.

First, an attacker can bypass authentication and obtain a SUPERUSER bearer token from the auto-login endpoint (/api/v1/auto_login). With this token, the attacker can then exploit the second stage, where they send a malicious Python function definition to the code validation endpoint (/api/v1/validate/code). This results in the execution of the `exec()` function during function definition time, allowing the attacker to run arbitrary Python code and commands with the privileges of the Langflow process.

Once exploited, the attacker gains significant capabilities. They can potentially access and steal sensitive information such as API keys, database credentials, and other secrets stored in the process environment. They can also explore and modify the flow definitions, stored credentials, and vector store connectors within the system. This can lead to the execution of OS commands, modification of the file system, and even further movement within the internal network.

The vulnerability is particularly concerning because, on successful exploitation, the attacker can operate with the same privileges as the Langflow process. In default container setups, this means they could escalate to root privileges, significantly increasing their impact on the host and the container.

While no specific post-compromise activities have been disclosed, the potential for severe data breaches, lateral movement, and unauthorized access to sensitive systems is high. The vulnerability is particularly dangerous when the default container runs as root, as it allows for maximum impact on the host and container.

Security teams should be vigilant for signs of exploitation, such as external access to the auto-login endpoint, subsequent validate/code requests, and any abnormal network connections or shell activities from the Langflow process. Correlating the issuance of the SUPERUSER token with the subsequent code execution is crucial for early detection. However, the fact that the UI may appear normal and no user action is required makes this a stealthy threat.

To mitigate the risk, organizations using Langflow should ensure they have updated to version 1.10.1 or later. Additionally, restricting the endpoints to be non-reachable from untrusted networks, running services and containers with non-root privileges and least privilege access, and monitoring for abnormal correlations between token issuance and code validation requests are essential steps.

Monitoring for suspicious Python processes, shell activities, and unauthorized access to sensitive files and systems is also critical.