IBM · Langflow
CVE-2026-9198
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
Qué es
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
CISA: Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Qué hacer
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Plazo para las agencias federales de EE. UU.: 7 de agosto de 2026
Más fallos explotados de IBM
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 21 feb 2023 | Code Execution | Aspera Faspex | Crítica 9,8 | >99,9% |
| 25 may 2022 | Invalid Input | InfoSphere BigInsights | Media 6,5 | 4,8% |
| 10 ene 2022 | Code Injection. | WebSphere Application Server and Server Hypervisor Edition | Crítica 9,8 | 98% |
| 3 nov 2021 | Remote Code Execution | Planning Analytics | Crítica 10,0 | 86% |
| 3 nov 2021 | Security Bypass | Data Risk Manager | Crítica 9,0 | 70% |
| 3 nov 2021 | Remote Code Execution | Data Risk Manager | Crítica 9,1 | 62% |
| 3 nov 2021 | Directory Traversal | Data Risk Manager | Media 4,3 | 69% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.