IBM Langflow Under Active RCE Attack

Organizations utilizing IBM's agentic AI development platform are currently facing an immediate security threat as attackers actively exploit a critical vulnerability. The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the danger by adding the flaw to its catalog of known exploited vulnerabilities, signaling that the window for remediation is closing rapidly.

The Mechanics of the RCE Flaw

The vulnerability, tracked as CVE-2026-9198, allows unauthenticated remote code execution (RCE) on default installations of the platform. By chaining two distinct security failures, an attacker can gain complete control over a target server without requiring credentials.

The first component of the exploit targets an auto-login endpoint that erroneously grants superuser tokens to any network caller. Once this elevated access is secured, the attacker leverages a second weakness: a code validation endpoint that fails to sanitize input, allowing for the execution of arbitrary Python code. This combination effectively hands an intruder full administrative control over the underlying server environment.

Platform Ownership and Integration

Langflow originated as a project by Logspace before being acquired by DataStax in 2024. The platform was subsequently brought into the IBM ecosystem when IBM scooped up DataStax in 2025.

Following the transition, Langflow was integrated as middleware within watsonx.ai, IBM's primary studio for AI development. Despite the high-profile nature of these acquisitions and the platform's role in enterprise AI workflows, the underlying configuration issues persisted into production releases.

Scope of the Affected Versions

The security advisory issued by IBM confirms that the vulnerability is present in Langflow OSS versions 1.0.0 through 1.10.0. While the flaw is tied to default deployment configurations, the ease with which it can be exploited makes any unpatched instance a high-value target for unauthorized actors.

• Affected versions: Langflow OSS 1.0.0 through 1.10.0
• Required action: Upgrade to version 1.10.1 or later
• Current status: Exploitation active as of August 5, 2026
• CVE publication date: July 17, 2026

Remediation and Patching Guidance

To mitigate the risk of compromise, IBM recommends that administrators immediately upgrade their environments to version 1.10.1 or later. As of the most recent release, version 1.11.2 is available for deployment.

The speed at which this vulnerability moved from disclosure to active exploitation highlights the risks associated with default configurations in development tooling. Because the platform provides a drag-and-drop interface for constructing agentic and RAG workflows, it is often deployed in internal environments where network perimeters may not be as robust as production-facing infrastructure.

Implications for AI Infrastructure

The active exploitation of this platform serves as a stark reminder that even tools designed to simplify AI development are subject to traditional software security flaws. Organizations that adopted these tools for their accessibility may now find themselves managing significant technical debt regarding their security posture.

This incident underscores the necessity of auditing default settings in any third-party software before exposing it to a network. For teams relying on agentic AI to automate workflows, the ability for an attacker to run arbitrary code on an AI-enabled server could lead to data exfiltration or the manipulation of the very AI models the platform was designed to build.