IBM Langflow — unauthenticated auto_login endpoint mints a superuser token, chained with the code-validation endpoint for pre-auth code execution (CVSS 9.8); CISA KEV 2026-08-04; affects Langflow OSS 1.0.0-1.10.0

CVE-2026-9198 — a third Langflow pre-auth code-execution path reaches CISA KEV: an unauthenticated auto-login endpoint mints a superuser token, and code validation executes what it is handed

UPDATE · originally covered CVE-2026-0770 — Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.1 (2026-07-22)

CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on 2026-08-04, listing it as an IBM Langflow code-injection vulnerability, with the additions made on evidence of active exploitation (CISA, 2026-08-04). This is a different path from anything covered in the earlier Langflow entries, which dealt with the exec_globals code-execution endpoint and a Python-interpreter component flaw.

The chain here has two links, and the first is the reason there is nothing to brute-force: an unauthenticated caller reaches an auto-login endpoint that issues a superuser token, and then submits Python to a code-validation endpoint that executes what it is given during function definition — through decorators, default arguments and annotations, all of which run at definition time rather than at call time. IBM's bulletin rates the result CVSS 9.8 and records the affected range as Langflow OSS 1.0.0 through 1.10.0 (IBM PSIRT, 2026-07-02). IBM names 1.10.1 as the remediation for this flaw; operators should target 1.10.2, because this pipeline's 2026-07-26 correction established that the sibling flaw CVE-2026-14499 is only closed in 1.10.2.

The count is now the story. Three separate pre-authentication code-execution paths in this one product carry confirmed exploitation — CVE-2026-0770, CVE-2026-0769 and now CVE-2026-9198 — and CVE-2026-0769 still has no documented fixed version at all. A product whose unauthenticated attack surface has yielded three exploited paths in three weeks is not being picked at opportunistically; it is being worked systematically, and each individual patch buys less than the pattern costs.

Detection concepts, telemetry class first. The full chain appears in web and application access logs as two requests: an unauthenticated POST to the auto-login endpoint followed immediately by a POST to the code-validation endpoint from the same source. On the host, process-creation telemetry showing the Langflow Python or application-server process spawning a shell is the payoff stage.

Triage: the auto-login endpoint exists to serve a legitimate single-user convenience mode, so requests to it are not inherently malicious on an instance configured that way. The discriminator is what follows: a code-validation submission arriving from the same source within the same second, from an address outside the deployment's expected client range.

Builds on: 2026-07-26/langflow-1-10-2-required-cve-2026-0770-precondition-fix · 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev