Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
CVSS score
9.8
EPSS probability
%28.7
Risk score
5.6
Published
3 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
CISA Adds Four Vulnerabilities to KEV Catalog Aug 6 2026
Four Newly Added KEV Entries Reinforce the Growing Focus on Enterprise Management, AI, Middleware, and DevSecOps Platforms The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited…
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-9198"