An AI agent-builder platform just handed attackers root access with zero credentials required.
CVE-2026-9198 — CVSS 9.8 — Langflow code injection — added to CISA's Known Exploited Vulnerabilities catalog on August 4, 2026, with a public proof-of-concept already circulating. No login. No stolen password. Just two API calls.
WHAT ACTUALLY HAPPENED
Langflow is the platform thousands of teams use to visually build AI agent workflows. Versions 1.0.0 through 1.10.0 ship with a chainable flaw an attacker does not need credentials to trigger.
Step one: hit the /api/v1/auto_login endpoint. It mints a SUPERUSER authentication token for any caller on the network — no username, no password, no MFA prompt to bypass because there was never a check to begin with.
Step two: take that freshly minted token to /api/v1/validate/code, an endpoint built to test Python snippets inside the workflow builder. It runs attacker-supplied code straight through exec(). Arbitrary Python, full server context, no sandbox holding it back.
Two requests. Unauthenticated. Remote code execution. That is the entire attack chain, and it is why researchers are calling this "easily exploitable" rather than theoretical.
WHY THIS IS DIFFERENT FROM A TYPICAL RCE
Langflow instances orchestrate agent workflows wired into internal APIs, databases, and live credentials for downstream LLM providers. Compromise the host and you compromise everything the agents were trusted to touch.
This is the pattern to internalize: AI infrastructure gets deployed with hype-cycle urgency and hackathon-grade security maturity. A "convenience" endpoint like auto_login was never meant to survive contact with the internet — yet here it is, KEV-listed, PoC-public.
WHAT TO DO NOW
PATCH PAST 1.10.0 IMMEDIATELY — this is the only complete fix; there is no safe configuration workaround for the underlying design flaw.
TAKE UNAUTHENTICATED INSTANCES OFF THE INTERNET — if it does not need to be internet-facing, it should not be, until patched and re-verified.
AUDIT WHAT YOUR AGENTS COULD REACH — inventory every credential, API key, and internal system your Langflow deployment touched, and rotate anything a compromised instance could expose.
HUNT FOR PRIOR EXPLOITATION — review access logs for auto_login calls from unexpected sources and validate/code requests carrying unfamiliar payloads, dating back through your exposure window.
Your AI stack is only as secure as its least-scrutinized endpoint. Right now, that is the one nobody thought to lock.
Is your AI agent infrastructure inventoried and patched with the same discipline as your production network?