CVE-2026-9198 CISA KEV · Actively exploitedSuited to automated attack · CISA
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
CVSS score
9.8
EPSS probability
%28.7
Risk score
5.6
Published
3 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)
Makefile Go / Python
GitHub
Proof of concept exploit code for CVE-2026-9198
Makefile Go / Python
GitHub
IBM Langflow Unauthenticated RCE via Auto-Login Bypass
Makefile Go / Python
GitHub
Proof of Concept for CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass
Makefile Go / Python
Nuclei: IBM Langflow - Remote Code Execution
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2025-3248 Actively exploitedLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Patch verified Public Exploits:3EPSS %100
9.4
CVE-2025-34291 Actively exploitedLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Workaround Public Exploits:1EPSS %93
9.8
CVE-2026-0770 Actively exploitedVulnerability in Langflow
Patch status unknown Public Exploits:9EPSS %63
9.8
CVE-2026-33017 Actively exploitedCode injection in Langflow
Patch verified Public Exploits:14EPSS %25
9.8
CVE-2026-0769Vulnerability in Langflow
Patch status unknown Public Exploits:1EPSS %42
9.8
CVE-2026-0768Code injection in Langflow
Patch status unknown Public Exploits:4EPSS %23
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-9198"