Critical security flaw in IBM's Langflow platform
Unauthorized users can execute remote code
1Critical security flaw in Langflow
A critical security vulnerability has been discovered in IBM's low-code AI development platform Langflow. This flaw allows unauthorized users to execute remote code. The vulnerability affects Langflow OSS versions 1.0.0 through 1.10.0, and IBM recommends users upgrade to the latest version, 1.11.2.
2CISA's warning
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog. The agency found evidence of active exploitation and urged organizations to immediately apply IBM's recommended security measures.
3Function of Langflow
Langflow is a tool that allows users to create AI agents without coding knowledge. The platform is available on Linux, Windows, and macOS and operates through a drag-and-drop interface. IBM acquired Langflow in 2025 by purchasing DataStax and integrated the platform into watsonx.ai.
4Technical details of the flaw
The security vulnerability affects default Langflow installations and combines two issues: an auto-login endpoint and a code validation endpoint. The auto-login grants superuser privileges to any network call, while the code validation endpoint can execute any Python code.
5Potential risks
This flaw could allow malicious actors to take over Langflow servers or cause worse outcomes. The vulnerability specifically targets default installations where auto-login and code validation endpoints are left open.
6IBM's recommendations
IBM advises Langflow users to update the platform to the latest version and apply security measures immediately. The company has not yet provided detailed information on the extent of the exploitation.
7History of Langflow
Langflow was initially developed by Logspace and acquired by DataStax in 2024. IBM purchased DataStax in 2025, bringing Langflow under its umbrella. The platform was integrated into watsonx.ai as middleware to extend its capabilities.
8Security lessons
This incident highlights how risky default installations can be. Companies should implement stricter controls to prevent security vulnerabilities from slipping into production releases. The Langflow example underscores the critical importance of security in AI platforms.