On this month’s threat radar, one entry should make every team building with AI stop and check their stack: a critical, remotely exploitable flaw in IBM Langflow, the popular low-code builder for LLM and agent workflows. Tracked as CVE-2026-9198 and rated CVSS 9.8, it chains an authentication bypass into full remote code execution — no credentials required.
What happened
Langflow lets developers wire together prompts, models, vector stores and tools through a visual canvas. The vulnerability lets an unauthenticated attacker reach an exposed Langflow instance, mint a superuser token, and from there execute arbitrary code on the host. In other words: anyone who can reach the web interface can own the server it runs on. Instances published to the internet — and there are many, because these tools are spun up fast during experimentation — are being actively targeted.
Our take: your AI tooling is now attack surface
This is the pattern we keep flagging to clients. The rush to ship AI features has produced a whole new tier of infrastructure — orchestration frameworks, agent runtimes, vector databases, MCP tool servers — that is often deployed with the security maturity of a weekend hackathon. Langflow is not uniquely bad; it is representative. These platforms typically hold the crown jewels of an AI system: model API keys, retrieval sources full of proprietary or personal data, and — crucially — the ability to call tools and run code. A single RCE here is not one server; it is your model budget, your data pipeline and your integrations, all at once.
The uncomfortable truth is that most organisations have no inventory of these components. Ask yourself: who owns the Langflow instance a data scientist stood up three months ago, and is it reachable from the internet right now?
How an attacker turns this into real damage
The interesting part is what comes after the RCE. From a compromised AI-orchestration host, an attacker typically: harvests the API keys and secrets the workflows use; reads the vector store to exfiltrate whatever your RAG pipeline was indexing; and abuses any connected tools or MCP servers to reach further into your environment — internal APIs, cloud metadata endpoints, databases. An agent platform is valuable to attackers precisely because it was built to take actions on other systems. That is the same capability we probe in AI agent penetration testing and MCP server & tool-chain security testing.
What you should do
- Patch and inventory now. Update Langflow to the fixed release, then find every other AI-tooling instance you run — you almost certainly have more than you think.
- Get it off the public internet. These consoles should sit behind SSO and a VPN or IP allow-list, never exposed directly. Treat an AI builder like an admin panel, because that is what it is.
- Contain the blast radius. Scope model keys and tool credentials to the minimum, rotate anything that lived on an exposed host, and put egress controls around agent runtimes so a compromised workflow cannot freely call out.
- Test it like an attacker. A vulnerability scanner will not understand an agent’s tool-chain. Our AI supply chain security audit maps exactly these components, and LLM application penetration testing exercises the model, its data and its tools as one attack surface.
If you are shipping anything agentic, this CVE is your reminder that the model is rarely the weakest link — the plumbing around it is.