IBM Langflow CVE-2026-9198: CVSS 9.8 Unauthenticated RCE Exploited, Patch Before August 7

CVE-2026-9198 chains two design flaws in the Langflow REST API to achieve unauthenticated Python code execution in two HTTP requests.

The first request targets a Langflow API endpoint designed to support development and testing workflows. This endpoint accepts unauthenticated HTTP requests and responds with a superuser-level bearer token. In any deployment where the Langflow API port is reachable from the network, any attacker can call this endpoint and receive administrator credentials for the Langflow instance without providing a username, password, API key, or session cookie.

The second request uses the acquired superuser token to access Langflow's code validation endpoint. This endpoint is designed to let workflow builders test Python code components before deploying them in production pipelines. It accepts Python source code in the request body and executes it server-side. When called with a superuser token obtained from the first endpoint, the code validation service runs the submitted Python code with the operating system privileges of the Langflow server process.

Post-exploitation access includes reading and writing all Langflow workflow configurations, exfiltrating API keys and model credentials stored in environment variables, and launching outbound connections or deploying reverse shells for persistent access. Security researchers noted that the vulnerability results from authentication not being enforced at the API gateway level for endpoints originally intended for localhost-only access, a misconfiguration that frequently occurs when Langflow moves from a developer's local machine to a networked deployment without architectural review.

MITRE ATT&CK mappings: T1190 (Exploit Public-Facing Application) for initial access, T1059.006 (Python) for the code execution step, and T1552.001 (Credentials In Files) for API key extraction that follows.

CVE-2026-34486 is a CVSS 7.5 vulnerability in Apache Tomcat's EncryptInterceptor cluster communication component resulting from missing encryption of sensitive data during inter-node cluster traffic.

The Apache Software Foundation patched CVE-2026-34486 in April 2026 across Tomcat versions 11.0.21, 10.1.54, and 9.0.117. Despite the available fix, threat actors operating under the aliases "knaithe" and "KnYuan" -- attributed to operators based in Zhuhai, China -- launched an active exploitation campaign targeting Tomcat deployments across more than 460 endpoints worldwide. The campaign used a framework called Hermes Agent running on the DeepSeek LLM to automate reconnaissance, vulnerability identification, payload construction, and exploitation across target lists without continuous operator involvement.

The use of AI automation in the Tomcat campaign is operationally significant. Hermes Agent automated what would otherwise require constant human operator attention across hundreds of simultaneous targets. The same threat actors conducted parallel manual operations exploiting nine additional CVEs against 107 separate endpoints, suggesting a hybrid model where AI-automated tooling handles high-volume scanning while human operators focus on higher-value objectives.

Successful exploitation of CVE-2026-34486 allows attackers to intercept and manipulate unencrypted cluster communication between Tomcat nodes. In multi-node deployments, this enables session hijacking, data tampering, and in some configurations escalation to server-level access. Single-node Tomcat deployments without cluster configuration are not affected by this specific vulnerability.

CISA grouped CVE-2026-34486 with CVE-2026-9198 under the same August 4 KEV addition, sharing the August 7 remediation deadline. Organizations running Tomcat in cluster mode on unpatched versions face the same AI-automated adversaries who compromised 460 endpoints in this campaign.

CVE-2026-9198 affects all IBM Langflow OSS installations running versions prior to 1.10.1. This includes self-hosted Docker deployments, virtual machine installations, and any Langflow instance where the API port is reachable from a network segment that untrusted parties can access. IBM-managed cloud offerings may have applied the fix automatically; self-hosted operators must upgrade manually.

Organizations at risk from CVE-2026-9198 include enterprise teams using Langflow for internal AI application development, research organizations running AI workflow experiments on internet-facing infrastructure, development environments where Langflow was exposed to broader network ranges during prototyping, and any organization whose Langflow version is earlier than 1.10.1.

CVE-2026-34486 affects Apache Tomcat cluster configurations running EncryptInterceptor on versions prior to 11.0.21 (Tomcat 11 branch), 10.1.54 (Tomcat 10.1 branch), or 9.0.117 (Tomcat 9.0 branch). Single-node Tomcat deployments without cluster configuration are not affected by CVE-2026-34486 specifically.

The CISA KEV designation confirms active in-the-wild exploitation rather than theoretical proof-of-concept risk. The 460-endpoint Tomcat campaign and the Langflow exploitation confirm that automated adversaries have already indexed the exposed attack surface. Both the ServiceNow CVE-2026-6875 pre-auth RCE and the N-central CVE-2026-18577 MSP compromise followed the same pattern -- KEV addition within days of disclosure, exploitation at scale confirmed shortly after. Organizations treating CISA deadlines as federal-only requirements misread what the catalog represents: a public signal that attacks are already underway.

No specific IP addresses, domains, or file hashes for the CVE-2026-9198 Langflow exploitation campaign have been published as of August 6, 2026. Defenders should focus on behavioral detection and log analysis rather than IOC-based blocking.

Review Langflow access logs for exploitation patterns. Sequential API calls -- a token generation request followed immediately by a code execution endpoint call from the same source IP -- is the primary signature. Look for POST requests to Langflow API paths containing Python source code in the request body, particularly code referencing subprocess, os.system, socket, base64, or importlib, which are common components in post-exploitation payloads.

Post-exploitation behavioral indicators: unexpected outbound TCP connections from the Langflow server process to non-standard ports (reverse shells); child processes spawned by the Langflow Python process (bash, sh, curl, wget, nc, ncat); new .pth files created in Python site-packages directories at /lib/python3.*/site-packages/ (persistence mechanism that runs on every Python startup); and modified Langflow workflow configurations that include new external API calls or unfamiliar integration endpoints.

For Apache Tomcat CVE-2026-34486: verify your running Tomcat version with catalina.sh version and confirm the installed version against the patched branch. Review server.xml for EncryptInterceptor configuration in cluster sections. Monitor Tomcat cluster node communication logs for unencrypted inter-node traffic or anomalous session data patterns that suggest active interception.

Two behavior-based rules cover the critical post-exploitation and persistence patterns for Langflow exploitation.

Windows Webshell Strings (web server log sources fronting Langflow or Tomcat): Catches command execution patterns in HTTP access logs -- Python, wget, curl, and cmd arguments in GET request parameters -- indicating active code execution probing.

Python Path Configuration File (Linux hosts): Detects the .pth persistence mechanism. Attackers drop a malicious .pth file into site-packages so their payload executes on every Python startup, surviving process restarts.

Deploy both rules on the host running Langflow.

Apply the patch from the CISA August 4 Known Exploited Vulnerabilities advisory and follow the steps below. Federal agencies must complete remediation by August 7. All other organizations should treat that date as the target.

CVE-2026-9198 is a critical example of a vulnerability class that security teams must increasingly address: code execution weaknesses in AI development infrastructure.

Langflow sits at a privileged position in the enterprise network. It holds API keys for commercial LLMs, credentials for internal knowledge bases, database connection strings for RAG data sources, and permissions to trigger automated workflows. An attacker who achieves code execution via CVE-2026-9198 does not just own the Langflow server -- they inherit every credential and connection the platform uses to function. In many deployments, that includes access to internal data stores explicitly blocked from direct internet access.

The pattern is consistent with the ServiceNow CVE-2026-6875 pre-auth RCE, where code execution on an enterprise workflow platform gave attackers access to integrations far beyond the initial compromise point. AI development infrastructure follows the same logic but often with weaker access controls, because platforms like Langflow were built for developer productivity rather than hardened for production network exposure.

The concurrent Apache Tomcat CVE-2026-34486 campaign using DeepSeek-powered Hermes Agent against 460+ endpoints demonstrates that adversaries have fully operationalized AI-assisted exploitation at scale. One week is not a conservative CISA remediation window -- it is calibrated to the realistic pace at which automated adversaries scan, identify, and exploit exposed targets. IBM Langflow CVE-2026-9198 with a CVSS of 9.8 and confirmed exploitation is not a patch to schedule for next sprint. It is an emergency remediation for today.