IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

The version of Langflow running on the remote host is affected by two vulnerabilities that can be chained to achieve unauthenticated remote code execution:

  - CVE-2026-9103: The '/api/v1/auto_login' endpoint mints a superuser JWT bearer token to any unauthenticated caller     when the default AUTO_LOGIN configuration is enabled.

  - CVE-2026-8481: The '/api/v1/validate/code' endpoint compiles and evaluates attacker-supplied Python during     'validation' using an unsandboxed exec() whose globals expose importlib and Python builtins. Function     default-argument values and decorators are executed at definition time.

A remote, unauthenticated attacker can chain these flaws by first requesting a superuser token from the auto_login endpoint, then submitting crafted Python code to validate/code whose default argument executes arbitrary Python, and ultimately arbitrary operating system commands, as the Langflow service user.

Nessus confirmed the chain non-destructively by obtaining a token from /auto_login and coercing the target into performing an out-of-band callback (a DNS lookup and/or a direct socket connection) back to the Nessus scanner. No operating system commands were executed on the target.

Langflow is vulnerable to an attack allowing an unauthenticated attacker to execute arbitrary code via a specially forged request on the '/api/v1/validate/code' endpoint. This detection is included in the AI and LLM category.

The version of Langflow installed on the remote host is 1.x.x prior to 1.10.1. It is, therefore, affected by a code injection vulnerability:

  - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain     /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with     /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default     Langflow deployments. (CVE-2026-9198)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
334529	Langflow auto_login + validate/code Chain Unauthenticated RCE (CVE-2026-9198) (Direct Check)	Nessus	Artificial Intelligence	Remote	critical
115357	Langflow < 1.10.1 Remote Code Execution	Web App Scanning	Artificial Intelligence	Check Based	critical
333371	Langflow 1.x.x < 1.10.1 Code Injection	Nessus	Artificial Intelligence	Combined	critical

Detections

Analytics

CVE-2026-9198

critical

Tenable Plugins

critical

critical

critical