Langflow: anyone on the network can become admin and run code
Identifiers: CVE-2026-9198 · CVSS 3.1 9.8 (scored by IBM)
What it is
On a default Langflow install, /api/v1/auto_login hands an admin token to whoever asks, and /api/v1/validate/code runs the Python code it is sent. Together they give an attacker full control of the server and every LLM and API key stored in your flows. CISA lists it as exploited in the wild.
On CISA's Known Exploited Vulnerabilities list since August 4, 2026.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| PyPI | langflow | >= 1.0.0, < 1.10.1 | 1.10.1 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up langflow in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade langflow to 1.10.1 or later. Turn off auto-login, keep Langflow off the public internet, and rotate the provider keys and credentials stored in its flows.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.