THREATOPS

THREAT OPS › CVEs › CVE-2026-9198

CVE-2026-9198 — IBM Langflow Code Injection Vulnerability

CISA KEVExploited: confirmedIBM

Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

Vulnerability details

Affected productsLangflow
KEV remediation due2026-08-07

Related reporting

August 2026 CVE Landscaperecordedfuture
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploitedthehackernews
CISA Adds Three Known Exploited Vulnerabilities to Catalogcisa_advisories
[CISA KEV] CVE-2026-9198 — IBM Langflow: IBM Langflow Code Injection Vulnerabilitycisa_kev