Langflow is a low-code, drag-and-drop tool for building AI agent workflows, the kind of project a development team adopts in a weekend to prototype an internal chatbot or automation pipeline, then quietly leaves running because it works. CISA has now confirmed that a critical flaw in it, tracked as CVE-2026-9198, is being actively exploited, and the exploitation chain is almost embarrassingly simple for how much access it grants.
Two endpoints, zero credentials, full control
The vulnerability, carrying a CVSS score of 9.8, chains two API endpoints that were never meant to be reachable together by an unauthenticated caller. The first, /api/v1/auto_login, mints a SUPERUSER-level authentication token for any network caller, no credentials required, when Langflow is running in its default configuration. The second, /api/v1/validate/code, takes that token and executes attacker-supplied Python via exec(). Put the two together and an attacker with nothing more than network access to the Langflow instance has arbitrary code execution as an administrator, classified under CWE-94, improper control of generation of code. IBM patched the flaw in Langflow OSS 1.10.1 on 17 July, but every default deployment of versions 1.0.0 through 1.10.0 is affected, and fully functional public proof-of-concept exploits emerged before most organisations had a chance to patch.
Why CISA’s KEV listing matters here specifically
CISA reserves its Known Exploited Vulnerabilities catalog for flaws it has confirmed are being used in real attacks, not theoretical risk, and Langflow shipped alongside Apache Tomcat and N-able N-central flaws in the same batch of confirmed exploitation. What sets Langflow apart is who tends to run it: not a hardened production system managed by a platform team, but an AI workflow prototype spun up by a developer or data scientist, often on a server with a public IP and no change-management process behind it, because the whole appeal of low-code AI tooling is skipping exactly that friction.
What European teams building AI tooling should do now
If your organisation has anyone experimenting with AI agent frameworks, run an inventory now, not after the next audit, because these tools proliferate outside the asset lists that security teams normally rely on. Check specifically for Langflow instances below 1.10.1, confirm auto_login is disabled or the instance sits behind authentication at the network layer, and treat any internet-reachable AI tooling server as a priority patching target regardless of how experimental the team considers it. The broader lesson holds beyond this one CVE: as AI agent frameworks get adopted faster than security review processes can keep pace, “it’s just a prototype” is becoming one of the more dangerous sentences in a European engineering organisation.
If your team is deploying AI agent or low-code workflow tooling and needs a security review of what is currently reachable from the internet, or help building a patching process that covers shadow AI infrastructure, contact Excello Digital. We help European engineering teams find the AI tooling nobody remembered to lock down.