CISA KEV Catalog Addition: IBM Langflow Code Injection and Two Other Actively Exploited Vulnerabilities

Technical Analysis

CVE-2026-9198 is a code injection vulnerability in IBM Langflow, a low-code framework used to build and orchestrate LLM/agent pipelines; because Langflow executes user-supplied component code and chains, injection flaws here can allow an attacker to achieve arbitrary code execution within the agent orchestration environment, potentially compromising any agents, tools, or credentials that Langflow manages. The other two CVEs (N-able N-central authentication bypass and Apache Tomcat missing encryption) are traditional infrastructure vulnerabilities not specific to agentic AI but relevant if such systems host or front agent-based services. The entry point is any publicly exposed, unpatched Langflow instance; successful exploitation gives an attacker control over the flow engine, which can cascade into misuse of connected tools, APIs, and downstream agents orchestrated through Langflow pipelines.

Affected Systems

IBM Langflow, N-able N-central, Apache Tomcat

Detection Signatures

• Monitor for unexpected/unauthorized component or flow modifications in Langflow instances
• Log anomalous code execution or process spawning from the Langflow service account
• Check N-central authentication logs for access via unexpected paths/channels bypassing normal auth
• Inspect Tomcat traffic for unencrypted transmission of session tokens or credentials
• Review CISA KEV catalog and vendor advisories for IOCs tied to these specific CVEs

Remediation Steps

1. 1

   Patch IBM Langflow immediately

   Apply the vendor-provided fix for CVE-2026-9198 and audit any publicly exposed Langflow instances for signs of prior exploitation or unauthorized flow/component changes.

2. 2

   Remediate N-able N-central authentication bypass

   Apply patches for CVE-2026-18556 and review authentication logs for evidence of bypass via alternate paths.

3. 3

   Address Apache Tomcat encryption gap

   Patch CVE-2026-34486 and ensure sensitive data (session IDs, credentials) is transmitted only over encrypted channels.

4. 4

   Follow BOD 26-04 guidance

   FCEB agencies should prioritize remediation per CISA's Binding Operational Directive and check for prior compromise before/after patching; other organizations should adopt equivalent risk-based patching timelines.

5. 5

   Isolate and harden agent orchestration platforms

   Restrict public exposure of Langflow and similar agent-building tools, apply least-privilege to service accounts, and monitor for anomalous code execution within flow engines.