IBM Langflow Auto-Login to Code-Execution Chain (CVE-2026-9198)

Technical Analysis

The /api/v1/auto_login endpoint issues valid SUPERUSER authentication tokens to any caller without verifying identity, effectively acting as a built-in authentication bypass. An attacker uses this token to call /api/v1/validate/code, an endpoint that passes user-supplied input directly into Python's exec(), resulting in arbitrary code execution in the context of the Langflow server process. Because Langflow orchestrates agent flows, tool integrations, and credentials, this RCE crosses from a single API endpoint into full compromise of any connected tools, secrets, databases, or downstream agents. No authentication, user interaction, or prior access is required, and the flaw is present in the default configuration, making it trivially exploitable at internet scale.

Affected Systems

IBM Langflow

Detection Signatures

• Unauthenticated POST requests to /api/v1/auto_login followed by requests to /api/v1/validate/code from the same IP/session
• SUPERUSER-scoped JWT/token issued without prior credential submission
• Unexpected exec()/eval() invocation in Langflow application logs
• Outbound connections or process spawning immediately following /validate/code calls
• Langflow instances reachable on public interfaces without reverse-proxy authentication enforcement

Remediation Steps

1. 1

   Patch immediately

   Upgrade Langflow to a fixed version beyond 1.10.0 as soon as IBM/Langflow publishes a patched release.

2. 2

   Restrict network exposure

   Do not expose Langflow's API directly to the internet; place it behind a VPN, firewall, or authenticating reverse proxy.

3. 3

   Disable or gate auto_login

   Remove, disable, or strictly restrict access to /api/v1/auto_login until patched, ensuring it cannot mint superuser tokens for anonymous callers.

4. 4

   Sandbox code execution

   Isolate any code-execution endpoints (like /validate/code) in a hardened, least-privilege sandbox/container separate from production credentials and data.

5. 5

   Rotate credentials

   Rotate all API keys, tokens, and secrets accessible to the Langflow deployment in case of prior compromise.

6. 6

   Monitor logs

   Audit historical access logs for calls to the affected endpoints and investigate any suspicious superuser token issuance.