CVE-2026-9198: Langflow Auto-Login to Code-Validation RCE Remediation

IBM Langflow OSS 1.0.0 through 1.10.0 allows an unauthenticated network caller to chain two default endpoints into remote code execution. First, /api/v1/auto_login mints a SUPERUSER bearer token to any reachable client when auto-login is enabled. Second, /api/v1/validate/code executes submitted Python during function definition (decorators, default arguments, and annotations). Together they give full host execution on default deployments.

This is not closed by the CVE-2025-3248 upgrade to Langflow 1.3.0. That earlier KEV required authentication on code validation; CVE-2026-9198 recovers a superuser token from auto-login and reuses the validation sink through 1.10.0. The IBM bulletin's fix is Langflow OSS 1.10.1. NVD CPE >= 1.0.0 excludes 1.10.1. Live GHAD GHSA-5wm9-vgmg-cjv6 has vulnerabilities empty and no first_patched. Do not invent 1.10.2. Do not flatten leftover 139 langflow-base 0.3.0 onto this later CVE. CISA added CVE-2026-9198 to the Known Exploited Vulnerabilities catalog on 2026-08-04 (required action due 2026-08-07).

Do not prove exposure by calling auto-login, submitting code, or executing decorators. Inventory versions and ingress; then patch.

When to use it

• A repository deploys, builds, pins, vendors, or documents Langflow 1.0.0–1.10.0.
• Langflow is exposed through reverse proxies, gateways, Kubernetes ingress, tunnels, devcontainers, shared workbenches, or hosted notebooks.
• You already applied CVE-2025-3248 (1.3.0+) and need the follow-on fix for auto-login plus code validation.
• You need a bounded PR that upgrades Langflow to 1.10.1+, contains both routes during rollout, and documents credential rotation.

Inputs

• Python dependency files, lockfiles, Dockerfiles, compose/Helm/K8s/Terraform manifests, gateway/proxy config, environment templates, SBOMs, and runbooks.
• Langflow version evidence, auto-login setting, validation-route ownership, auth dependencies, ingress exposure, logs, and credential rotation owners.
• Available dependency install, API auth tests, gateway policy tests, container build, deployment render, SBOM, and dependency/security scan commands.

Affected versions

• Vulnerable / NVD CPE: Langflow OSS >= 1.0.0 last-affects below 1.10.1, including builds that already contain the CVE-2025-3248 authentication change.
• Fixed / NVD CPE and vendor: NVD excludes 1.10.1. IBM names 1.10.1.
• GHAD: GHSA-5wm9-vgmg-cjv6 has vulnerabilities empty. There is no GHAD first_patched.
• Do not invent: 1.10.2, or flatten leftover 139 langflow-base 0.3.0 onto this later CVE.
• Affected endpoints: GET/POST /api/v1/auto_login (token mint) and POST /api/v1/validate/code (code execution sink).
• Weakness: CWE-94 improper control of code generation/execution, chained with missing authentication on auto-login.
• CISA KEV: yes; added 2026-08-04 with required action due 2026-08-07.
• IBM workaround: none. Upgrade is the remediation.

Indicator-of-exposure

• The repository deploys, builds, vendors, pins, or documents Langflow 1.0.0–1.10.0.
• Auto-login remains enabled or the auto-login route is reachable.
• Public or unauthenticated traffic can reach /api/v1/auto_login or /api/v1/validate/code.
• The Langflow process can reach model provider keys, database credentials, flow secrets, package tokens, cloud metadata, or mounted source.

Quick checks:

rg -n "langflow|LANGFLOW|auto_login|AUTO_LOGIN|/api/v1/validate/code|/api/v1/auto_login" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"

Windows:

rg -n "langflow|LANGFLOW|auto_login|AUTO_LOGIN|/api/v1/validate/code|/api/v1/auto_login" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"

Do not call /api/v1/auto_login, submit code to /api/v1/validate/code, execute decorators, or dump environment variables.

Remediation strategy

• Upgrade every controlled Langflow dependency, lockfile, image, Helm chart, compose service, deployment manifest, SBOM, and runbook to langflow 1.10.1+. Do not stop at 1.3.0 from CVE-2025-3248.
• Until rollout is complete, deny /api/v1/auto_login and /api/v1/validate/code at the gateway.
• Disable auto-login on any shared or network-exposed deployment. Require an authenticated current user before code validation, and restrict that capability to a trusted role where the product supports it.
• Isolate Langflow with least privilege: remove cloud metadata reachability, avoid host mounts and Docker socket access, restrict egress, and keep secrets out of logs.
• Review logs for auto-login and validate/code traffic. Rotate Langflow, model provider, database, package, cloud, and workflow credentials when either route was reachable by untrusted callers.

The prompt

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-9198, a critical Langflow unauthenticated RCE
that chains `/api/v1/auto_login` token minting with `/api/v1/validate/code`
through Langflow 1.10.0. Produce exactly one output:

- A reviewer-ready PR/change request that upgrades Langflow to 1.10.1+,
  contains both routes during rollout, adds safe regression coverage, and
  documents operator cleanup, or
- TRIAGE.md if this repository does not own an affected Langflow runtime.

## Rules

- Scope only CVE-2026-9198 and directly related Langflow auto-login, code
  validation, authentication, ingress, isolation, and credential cleanup.
- A prior upgrade to 1.3.0 for CVE-2025-3248 is not a complete fix.
- Treat flows, component code, tokens, provider keys, and logs as sensitive.
- Do not prove exposure by calling `/api/v1/auto_login`, submitting code to
  `/api/v1/validate/code`, executing decorators, spawning shells, or dumping
  environment variables.
- Do not leave auto-login enabled on shared or public deployments.
- Do not auto-merge.

## Steps

1. Inventory every Langflow runtime this repository controls, including
   pins that already claim CVE-2025-3248 is fixed.
2. A target is vulnerable if it resolves to Langflow `1.0.0` through
   `1.10.0` inclusive.
3. If Langflow is not owned here, stop with `TRIAGE.md` listing files
   checked, owner if known, observed version, and required `1.10.1+`.
4. Upgrade every controlled Langflow package and image to `1.10.1+`.
   Regenerate lockfiles, image digests, SBOMs, and docs as usual.
5. Deny `/api/v1/auto_login` and `/api/v1/validate/code` at the gateway
   until every runtime is patched. Disable auto-login on shared
   deployments.
6. Add safe tests:
   - dependency policy rejects `langflow < 1.10.1`;
   - unauthenticated auto-login does not mint a usable token;
   - unauthenticated and low-privilege callers cannot reach code
     validation;
   - tests never execute submitted code or log bearer tokens.
7. Add a PR body section named `CVE-2026-9198 operator actions` that
   states versions before and after, whether auto-login or validate/code
   was reachable, whether CVE-2025-3248 was already applied, which
   credentials to rotate, and any temporary edge block.
8. Use PR title:
   `fix(sec): remediate CVE-2026-9198 in Langflow`.

## Stop conditions

- No affected Langflow runtime is controlled by this repository.
- A fixed Langflow version cannot be consumed and the routes cannot be
  blocked at the edge.
- Meaningful verification would require minting tokens, executing
  submitted code, or exposing secrets.
- Validation fails for unrelated pre-existing reasons; document those
  failures instead of broadening scope.

Rollback

Do not restore Langflow 1.10.0 or earlier to a reachable deployment. If 1.10.1 must be withdrawn, keep /api/v1/auto_login and /api/v1/validate/code denied at the gateway or stop the public service until another fixed release is installed.

Verification - what the reviewer looks for

• No controlled dependency, image, SBOM, or runbook resolves Langflow 1.0.0–1.10.0.
• Auto-login is disabled on shared deployments and cannot mint a superuser token for an unauthenticated caller.
• /api/v1/validate/code requires authentication before any execution sink.
• Gateway containment is present when rollout is not atomic.
• Tests never call auto-login or execute submitted code.
• Operator notes cover the relationship to CVE-2025-3248, KEV urgency, log review, and credential rotation.

Output contract

• Reviewer-ready PR upgrading Langflow to 1.10.1+ and containing both routes during rollout.
• TRIAGE.md when Langflow ownership is outside this repository.

Watch for

• Stopping at Langflow 1.3.0 after CVE-2025-3248 and leaving 1.3.x–1.10.0 in production.
• Disabling the UI auto-login control while the API route still mints tokens.
• Testing with live tokens, submitted code, or environment dumps.
• Updating one requirements file while an image or Helm chart still runs 1.10.0.

Related recipes

• CVE-2025-3248 Langflow validate/code
• CVE-2026-55255 Langflow responses IDOR
• Search the CVE Database for CVE-2026-9198
• CVE intelligence intake gate

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9198
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198
• GitHub Advisory: https://github.com/advisories/GHSA-5wm9-vgmg-cjv6
• IBM Security Bulletin: https://www.ibm.com/support/pages/node/7278927
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-9198