CVE-2026-9198Vulnerability
IBM Langflow Code Injection Vulnerability
Reported by 5 independent sources · first reported by Rapid7 · last reported
Last reported 9 days ago
Fix due 7 Aug 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 98% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts“… engaged in generic brute-force attacks, as well as exploiting other flaws in Flowise (CVE-2026-69255) and Langflow (CVE-2026-55255, CVE-2026-9198, and CVE-2026-0768).”
-
The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws“CVE-2026-9198 — Langflow”
-
Q3 2026 Vulnerability Trend Report“CVE-2026-9198 A authentication bypass vulnerability in IBM Langflow OSS posed a risk of gaining administrator privileges, remote code execution, and internal LLM API key theft and credential theft for the vector DB.”
-
August 2026 CVE Landscape“In August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).”
-
Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!“Description: Adds an exploit module for CVE-2026-9198, an unauthorized RCE vulnerability in Langflow versions 1.10.0 and below.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-63030, CVE-2026-60137, CVE-2026-59310, CVE-2024-4577, CVE-2025-68613, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300, CVE-2026-33017, CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, CVE-2019-12263, CVE-2017-0199, CVE-2022-0847, CVE-2023-46604
Thanks — we review every report.