Federal agencies have three months to patch or shut down systems running IBM Langflow. The deadline is August 7, 2026, following CISA's addition of a critical vulnerability to its Known Exploited Vulnerabilities catalog on August 4. The flaw, CVE-2026-9198, scored 9.8 on the CVSS scale, allows attackers to seize full control without any authentication.

The attack is simple enough to execute on default setups. An attacker hits the /api/v1/auto_login endpoint, which mints a SUPERUSER token when LANGFLOW_AUTO_LOGIN=true, the factory setting. From there, they move to /api/v1/validate/code and run arbitrary Python code through exec(). No credentials needed. Proof-of-concept code circulated in July, and active exploitation is already happening in the wild.

What makes this worse than most

Langflow isn't some niche tool. It's now part of IBM's watsonx portfolio after DataStax was acquired, serving as the orchestration layer for AI agent workflows. When an attacker gains RCE, they don't just compromise a server, they control the entire agent pipeline. That means manipulating AI decisions and outputs across whatever systems rely on those agents.

This vulnerability fits a troubling pattern. CVE-2026-33017, another unauthenticated RCE rated 9.3, got exploited within 20 hours of going public. CVE-2026-55255 exposed an IDOR flaw that let attackers harvest LLM provider keys, cloud credentials, and database secrets. The recurring theme is broken authentication boundaries in the agent infrastructure stack.

Industry wakes up, but slowly

The disclosure timing coincides with Black Hat USA 2026, where agent infrastructure security has become the dominant conversation. Security researchers and vendors are finally treating this as critical, but the fact that it took multiple critical flaws to get attention suggests the space moved faster than defenses could keep up.

Under CISA's Binding Operational Directive 26-04, agencies must do more than patch. They're required to perform forensic triage to figure out if attackers already compromised their systems before patches went live. For agencies running Langflow on default configs, that's a serious archaeology project.

This article is for informational purposes and does not constitute financial or security advice. Organizations should consult with security professionals regarding their specific deployment risks.