Actively Exploited IBM Langflow Vulnerability Allows Unauthenticated Remote Code Execution
BeyondMachinesIBM Langflow OSS injection vulnerability (CVE-2026-9198)is actively exploited. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and requires immediate patching/
Summary
IBM Langflow OSS injection vulnerability (CVE-2026-9198)is actively exploited. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and requires immediate patching/
Take Action:
If you run IBM Langflow OSS (versions 1.0.0 through 1.10.0), update to version 1.10.1 or later immediately. Attackers are already using this flaw to take over servers. If you can't update immediately, take the Langflow instance off the internet, and check your logs for unexpected superuser tokens or odd Python code being run.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines