Critical RCE Vulnerability in IBM Langflow OSS Exploited

## Overview IBM Langflow OSS versions 1.0.0 through 1.10.0 are vulnerable to a critical remote code execution (RCE) exploit. This vulnerability, tracked as CVE-2026-9198, allows unauthenticated attackers to gain superuser access and execute arbitrary code. ## Technical Details The exploit takes advantage of two API endpoints: `/api/v1/auto_login` and `/api/v1/validate/code`. The first endpoint mints SUPERUSER tokens for any network caller without authentication. The second endpoint executes user-provided code using the `exec()` function. By chaining these two endpoints, an attacker can gain full control over the Langflow deployment. The CVSS score for this vulnerability is 9.8, indicating a critical risk. ## Impact If successfully exploited, this vulnerability allows attackers to execute arbitrary commands on the server. This can lead to data breaches, service disruptions, and unauthorized access to sensitive information. Organizations using affected versions of IBM Langflow OSS are at high risk, especially if they have default configurations. ## Mitigation Defenders should immediately upgrade to the latest version of IBM Langflow OSS to mitigate this vulnerability. Ensure that all installations are patched to at least version 1.10.1, where this issue is resolved. Additionally, restrict access to the API endpoints and implement network security measures to limit exposure. Regularly review logs for any unauthorized access attempts and conduct security assessments to identify potential vulnerabilities.