Case langflow-summer-2026-kev-waveAI supply chainWorldwide
Langflow hit by four more KEV listings in 2026: token hijack, IDOR, root RCE and auto_login chain
Between May and August 2026 CISA added CVE-2025-34291, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198 to KEV; the last chains an auto_login endpoint issuing superuser tokens with code validation exec() for unauthenticated RCE on default installs.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 4, 2026
- Location
- Worldwide
- Target
- Langflow AI agent workflow servers
- Severity
- Critical
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- CVE-2026-9198
What happened
Between May and August 2026 CISA added CVE-2025-34291, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198 to KEV; the last chains an auto_login endpoint issuing superuser tokens with code validation exec() for unauthenticated RCE on default installs.
Impact: Unauthenticated full compromise of default Langflow deployments and account takeover of authenticated users; number of victims not disclosed
Who triggered it
Actor: Unknown
Attribution: CISA marked each CVE as actively exploited; no public attribution of the campaigns
Motive: Unknown; Langflow hosts typically hold LLM API keys and pipeline data
How it happened
Attack vector: Credentialed cross-origin token refresh, IDOR on /api/v1/responses, exec_globals abuse on the validate endpoint, and the auto_login plus validate/code chain
Root cause: Repeated authentication and code-execution design weaknesses across Langflow 1.4 through 1.10
Timeline
- CVE-2025-34291 (CORS and SameSite token hijack to RCE, CVSS 9.4) added to KEV
- CVE-2026-55255 (IDOR running other users' flows, fixed in 1.9.1) added to KEV
- CVE-2026-0770 (unauthenticated root RCE via exec_globals, ZDI-26-036) added to KEV
- CVE-2026-9198 (auto_login superuser token chain, fixed in 1.10.1) added to KEV
Response
Upgrade to Langflow 1.10.1 or later; IBM, which now maintains Langflow, issued advisories and federal remediation deadlines applied
Current status: Patched
Sources (open in a new tab)
- CISA KEV CVE-2026-9198 cisa.gov
- CISA KEV CVE-2025-34291 cisa.gov
- IBM advisory ibm.com
- Langflow advisory GHSA-qrpv-q767-xqq2 github.com
Cite this case
Langflow hit by four more KEV listings in 2026: token hijack, IDOR, root RCE and auto_login chain. AI Threat Watch, case langflow-summer-2026-kev-wave, Aug 4, 2026. https://aithreat.io/cases/langflow-summer-2026-kev-wave/
Permanent link: https://aithreat.io/cases/langflow-summer-2026-kev-wave/