A security flaw has been identified in IBM Langflow, a tool some website and project owners use to build and manage automated workflows. The issue is a code injection vulnerability, a type of security gap that allows unauthorized parties to run their own malicious code on affected systems.
This flaw is particularly risky because attackers do not need any valid login credentials to exploit it on default Langflow deployments. If successfully leveraged, the vulnerability gives an attacker full control over the server running the default Langflow setup. This could let them access or delete your data, disrupt any websites or services hosted on that server, or use the compromised system to carry out further malicious activity.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-9198
