Analysis
CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 5 after identifying evidence of active exploitation, [The Register](https://www.theregister.com/security/2026/08/05/ibms_agentic_ai_platform_is_under_active_attack_patch_now/5283535) reported. The flaw affects Langflow, the low-code agentic AI builder IBM acquired and folded into watsonx.ai, in open-source versions 1.0.0 through 1.10.0. Version 1.10.1 and later are patched; the current release is 1.11.2.
The bug chains two separate weaknesses into unauthenticated remote code execution on a default deployment. An auto-login endpoint mints superuser tokens for any caller that can reach it over the network, and a code validation endpoint executes arbitrary Python. Neither is exotic on its own; together, on a default configuration, they hand an anonymous attacker a shell.
“The CVE was published July 17, and CISA's KEV listing on August 5 means the window between disclosure and observed exploitation was under three weeks.”
The exposure pattern is what makes this severe rather than routine. Langflow instances are typically stood up by data teams experimenting with agent workflows, frequently on cloud hosts reachable from the internet, and frequently holding credentials for the databases and SaaS APIs those agents call. Compromising the orchestrator is more valuable than compromising any single agent because the orchestrator holds every key.
The CVE was published July 17, and CISA's KEV listing on August 5 means the window between disclosure and observed exploitation was under three weeks. Federal civilian agencies face a binding remediation deadline under BOD 22-01; everyone else should treat KEV inclusion as evidence that scanning for exposed Langflow instances is already automated.
The practical action is unglamorous: inventory Langflow deployments, patch to 1.10.1 or later, and take anything internet-reachable off the public network. What to watch is whether this pattern repeats across the agent-orchestration tier -- LangChain, LlamaIndex, Flowise and n8n share the same profile of powerful, credential-holding, casually deployed infrastructure.
