BCY-ADV-2026-022
CRITICAL — CVSS 9.8 — UNAUTHENTICATED RCE
Langflow Unauthenticated Remote Code Execution — CVE-2026-9198
650 Exploitation Attempts · 244 Source IPs · 41 Countries · CISA KEV
CVE-2026-9198
CVSS 9.8
CWE-94
T1190
T1496
Langflow
AI Infrastructure
CISA KEV
Actively Exploited
Prepared by Warren Barr · Barr Cyber LLC · barr-cyber.com · August 2026
What This Is
CVE-2026-9198 is a code-injection flaw in Langflow, the open-source visual builder for AI agent and LLM workflows. It scores CVSS 9.8, and it allows an unauthenticated attacker to achieve full remote code execution on a default deployment.
No credentials. No user interaction. Default configuration. Fixed in version 1.10.1, released July 2026.
KEVIntel telemetry records 650 exploitation attempts beginning 6 July 2026, from 244 unique attacker IP addresses across 41 countries. This is not theoretical and it is not targeted — it is broad, opportunistic internet-wide scanning.
This Is A Pattern, Not An Incident
Langflow has been weaponised repeatedly through 2026. Earlier flaws in the platform were used to deploy
Monero cryptominers, and it is a documented target of
EncForge ransomware, a family specifically going after AI infrastructure. A separate Langflow RCE — CVE-2026-33017, also 9.8 — was the
first thing the autonomous AI campaign in
BCY-ADV-2026-021 reached for.
Attackers have worked out something defenders mostly have not: AI development platforms are soft, valuable, and rarely inventoried. They get stood up quickly during a proof of concept, they hold API keys for expensive model providers, they often have network reach into internal data, and nobody puts them on the patch schedule because nobody wrote them down as production.
Why This Hurts More Than A Normal RCE
Consider what a Langflow instance typically has sitting in it:
API keys OpenAI / Anthropic / Azure / AWS Bedrock — billable
Vector stores often loaded with real internal documents
DB connections the "just for the demo" read-only creds that were not
Network position inside the perimeter, because that is where the data is
Webhooks outbound integrations into Slack, ticketing, CRM
An RCE on a web server gets an attacker a web server. An RCE on a workflow builder gets them a credential store with a network position — and a model-provider bill they can run up on your account while they decide what else to do.
Am I Exposed?
The first question is not "is it patched" — it is "do we have one." The dangerous instance is the one somebody spun up in March to try something and never took down.
# Anything listening on the Langflow default port
ss -tulpn | grep :7860
netstat -ano | findstr :7860
# Containers, including stopped ones
docker ps -a --format '{{.Names}}\t{{.Image}}\t{{.Ports}}\t{{.Status}}' | grep -i langflow
# Python installs anywhere on the box
pip list 2>/dev/null | grep -i langflow
find / -name "langflow*" -maxdepth 6 -not -path "*/proc/*" 2>/dev/null
# And the one that actually finds them: what is exposed to the internet?
# check your external attack surface for :7860 and for any
# reverse-proxied hostname containing flow / agent / ai / llm
Then check the version. Anything below 1.10.1 is vulnerable to this issue.
Signs It Already Happened
CRYPTOMINING (the most common outcome on these)
sustained CPU at or near 100% with no corresponding workload
outbound connections to mining pool ports 3333 / 4444 / 5555 / 14444
processes named xmrig, kdevtmpfsi, kinsing, or random 8-12 char strings
new cron entries or systemd timers re-launching a binary from /tmp
RANSOMWARE (EncForge targets AI infrastructure specifically)
vector store / model artifact directories encrypted or renamed
ransom notes in workflow and data directories
CREDENTIAL THEFT
model-provider usage spiking outside business hours
API calls from regions you do not operate in
new keys created in your provider console that nobody requested
GENERIC
child processes spawned by the Langflow process that are not Python
outbound connections from the Langflow host to anything unexpected
The billing alarm is the honest one. Most organisations running Langflow will discover a compromise from a model-provider invoice, not from an EDR alert — because the instance was never onboarded into monitoring in the first place.
Remediation
Assessment
Nothing about this vulnerability is novel. A code-injection flaw reachable without authentication is the oldest critical there is. What is new is where it lives.
Every organisation that experimented with AI in the last two years has some quantity of this — tools stood up fast, holding real credentials, sitting inside the network, outside the asset inventory, and off the patch schedule. It is shadow IT with an expensive API key attached, and attackers are scanning for it at a rate of hundreds of attempts from hundreds of addresses.
If you take one action from this advisory, make it the inventory rather than the patch. The patch fixes the instance you know about.
Sources
BCY-ADV-2026-022 · Published August 2026 · Barr Cyber LLC · Kalispell, MT
More like this, when it happens
Advisories only. No newsletter, no marketing, unsubscribe in one click.
Barr Cyber — Developer Endpoint & Supply Chain Hardening
Developer workstations hold cloud credentials, signing keys and live sessions — which is exactly why this campaign targets them. If your team installs open-source tooling or AI capabilities as part of normal work, and nothing is watching what gets executed from AppData, that gap is worth closing before it is found for you.
Get in Touch →
