CVE-2026-9198

IBM Langflow Vulnerability

Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

CVSS Score

9.8

CRITICAL

Published

04 Aug 2026 00:00

Modified

N/A

Vendor

IBM

Product

Langflow

Source

CIRCL

Affected Versions

Fix Vendor Patch / Mitigation Available

Weaknesses (CWE)

CWE-94

References

nvd.nist.gov /vuln/detail/CVE-2026-9198 cve.circl.lu /cve/CVE-2026-9198 cve.mitre.org /cgi-bin/cvename.cgi vuldb.com /

Affected Systems

IBM

Langflow

IBM

Langflow

External Links

NVD Database CIRCL CISA KEV

KEV Status

Known Exploited Vulnerability