Langflow RCE is on CISA's KEV list. Deadline is August 7.

The AI agent builder your team spun up to prototype a workflow is now a confirmed entry point. CVE-2026-9198 in Langflow carries a CVSS of 9.8 and hands an unauthenticated attacker full remote code execution on a default deployment. CISA added it to the Known Exploited Vulnerabilities catalog this week with a federal remediation deadline of August 7, 2026. If you run Langflow anywhere — including that container someone started in April and forgot — patch it today.

What actually happened

Per SecurityWeek, the bug is a chain of two mistakes, and the chain is what makes it ugly. IBM's description: an attacker obtains "a superuser token from the auto-login endpoint, then uses that token to submit malicious code to the validation endpoint."

Read that again. One endpoint hands out superuser bearer tokens to any caller on the network. A second endpoint executes arbitrary Python. Neither needs a credential you have to steal first.

IBM patched it in Langflow OSS 1.10.1 on July 17. Proof-of-concept code appeared publicly about a week later. CISA added the CVE to KEV on August 4, per SecurityWeek — The Hacker News dates the batch August 5 — alongside an Apache Tomcat flaw and an N-able N-central authentication bypass. Federal civilian agencies have until August 7 under BOD 26-04. You are not bound by that deadline, and you should use it anyway.

This is the second Langflow entry on KEV in under a month. The first, a cross-tenant IDOR, leaked stored LLM and cloud credentials. Different bug, same lesson.

Why patching your AI agent builders matters for your business

Low-code AI tools get deployed like toys and exposed like servers. Langflow, n8n, agent frameworks, MCP servers — these arrive through a developer trying something on a Friday, not through procurement. They end up on a public IP with default settings because the whole pitch is that setup is easy. Nobody puts them in the patch calendar because nobody wrote them down.

So write them down. Inventory every AI tool with a listening port: what it is, who started it, what version, what it can reach. If you cannot produce that list in ten minutes, that is the actual finding here, not the CVE.

These boxes hold the keys to everything else. An agent builder is configured with your model API keys, your database credentials, your webhook secrets. RCE on that host is not "a prototype got popped" — it is credential theft against your production stack. Assume anything that ran on an unpatched Langflow instance is compromised: rotate the LLM keys, the cloud keys, and the webhook secrets, in that order.

Default-open is a design choice you inherit. An auto-login endpoint that mints superuser tokens exists to make the quickstart pleasant. Every convenience feature in this category has the same shape. When you stand up an AI tool, the first thing to change is the thing that made it easy to start.

Sources: SecurityWeek, The Hacker News.