An AI development tool taken over in its default deployment - code injection in Langflow (CVE-2026-9198)
A code injection vulnerability in IBM Langflow has been added to CISA's Known Exploited Vulnerabilities catalog. Unauthenticated attackers can achieve full remote code execution on default deployments.
Key facts
- CVE IDCVE-2026-9198
- Affected (vendor / product)IBM Langflow
- CWECWE-94
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-08-07 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Code injection (CWE-94) allows unauthenticated attackers to achieve full remote code execution.
- CISA states explicitly that it holds on default Langflow deployments.
- It does not arise from misconfiguration, so an audit passes it over if the deployment matches the default.
- Langflow is a development tool for assembling language-model applications through a visual interface.
- Of the 1,687 KEV records this site holds as of 2026-09-02, 72 include CWE-94 and eight concern IBM products.
- The due date is three days after addition; only 86 of the 1,687 carry a three-day deadline.
1The weight of "default deployments"
CISA's description says the vulnerability holds on default Langflow deployments. It is not dangerous because something was misconfigured; it is dangerous as it stands when brought up.
Environments stood up for evaluation mid-development are exactly the ones left at their defaults. That the stage before production design becomes the way in is what makes this shape awkward in practice.
2Development tools as a target
Langflow is a development tool for assembling applications that use language models through a visual interface. A development tool appearing in KEV shows attackers targeting not only production services but the development environments in front of them. Development environments often hold credentials and test data, opening a path onward into production.
3Unauthenticated, straight to full execution
That CISA writes "unauthenticated attackers can achieve full remote code execution" states the seriousness plainly. There is no authentication at the entrance and code execution at the destination, with no intervening stage. The three-day deadline reads as following from that directness.
Why it matters
Environments stood up for development or evaluation fall outside asset management easily and are left at their defaults for long periods. They often hold credentials and test data, opening a path onward into production. An AI development tool appearing in KEV shows that taking stock of development environments, not only production services, is required.
FAQ
Can reviewing configuration prevent it?
What is Langflow?
Why is the deadline three days?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).