Langflow versions 1.0.0 through 1.10.0 have a trivial unauthenticated RCE: two unguarded API endpoints chain together to hand out superuser access, then execute arbitrary code. CISA added it to its Known Exploited Vulnerabilities catalog today, citing active exploitation.
The catch: Langflow released the fix over a month ago. Version 1.10.1 landed in July, and the vulnerability itself was trivial enough that it would take seconds to craft an exploit. So why the delay between a patched release and CISA’s formal notice?
The most likely answer is that exploitation was quiet, enough to reach CISA’s threshold for active use in the wild, but not noisy enough to generate public chatter before disclosure. It’s a reminder that a month is a long window. Federal agencies have until August 7 to patch, but if this thing was already being actively exploited last month, that deadline may come too late for anyone running old versions.
Sources: CVE-2026-9198 at NVD • Langflow v1.10.1
Coverage: The Hacker News
Related on this blog: JADEPUFFER’s 19-Day Upgrade: Ransomware Built to Destroy AI Models • The diffusers trust_remote_code Bypass Was Patched in May • 54 Fake CVEs in Four Days, and Nobody Checked