Description
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Published: 2026-07-17
Score: 9.8 Critical
EPSS: 17.1% Moderate
KEV: Yes
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw allows unauthenticated callers to first obtain a superuser token via the /api/v1/auto_login endpoint. With that token they can then call /api/v1/validate/code, where user‑supplied code is executed via exec(). This chaining grants an attacker full remote code execution on any Langflow instance that exposes both APIs.

Affected Systems

IBM Langflow OSS versions 1.0.0 through 1.10.0 are affected. Default deployments of the application that expose the auto_login and validate/code endpoints are at risk. The vulnerability is removed in version 1.10.1.

Risk and Exploitability

The CVSS score of 9.8 marks this vulnerability as critical. Its EPSS score is 17% and it is listed in the KEV catalog, yet the impact remains high because an attacker only needs to issue two simple HTTP requests over the network; no credentials or special setup are required. Systems exposed to the internet face amplified risk.

Generated by OpenCVE AI on August 5, 2026 at 14:46 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.1 https://pypi.org/project/langflow/

OpenCVE Recommended Actions

  • Upgrade IBM Langflow OSS to version 1.10.1.
  • Disable the /api/v1/auto_login endpoint or require authentication before issuing superuser tokens.
  • Restrict network exposure of the application or apply firewall rules to limit access to the API endpoints.

Generated by OpenCVE AI on August 5, 2026 at 14:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-08-04T00:00:00+00:00', 'dueDate': '2026-08-07T00:00:00+00:00'}

Fri, 17 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Title Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
First Time appeared Ibm
Ibm langflow Oss
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:langflow_oss:1.10.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm langflow Oss
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Langflow Oss
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-05T03:56:04.369Z

Reserved: 2026-05-21T15:40:11.465Z

Link: CVE-2026-9198

cve-icon Vulnrichment

Updated: 2026-07-17T17:52:22.749Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T15:00:05Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')